@oneuptime/common 12.0.13 → 12.0.14

package/build/dist/Server/API/UserPushAPI.js

@@ -11,6 +11,31 @@ import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedExc
 import ObjectID from "../../Types/ObjectID";
 import PushDeviceType from "../../Types/PushNotification/PushDeviceType";
 import UserPush from "../../Models/DatabaseModels/UserPush";
+/*
+ * Booleans arrive from the mobile client as JSON booleans, but the same routes
+ * get called by hand and from form posts where "true" is a string.
+ *
+ * On REGISTRATION, absence is the normal case and means off: overriding a
+ * silenced phone is never something a device registration turns on by itself.
+ */
+export function parseCriticalAlertFlag(raw) {
+    return raw === true || raw === "true";
+}
+/*
+ * On the toggle route the caller is stating an intent, so an unrecognised
+ * value is refused rather than read as false. Quietly storing "off" for a
+ * client that meant "on" leaves a responder believing their phone will ring
+ * while it will not, and nothing surfaces the mistake until a missed page.
+ */
+export function parseCriticalAlertFlagStrict(raw) {
+    if (raw === true || raw === "true") {
+        return true;
+    }
+    if (raw === false || raw === "false") {
+        return false;
+    }
+    throw new BadDataException("isEnabled must be either true or false.");
+}
 function getAuthenticatedUserId(req) {
     var _a;
     const userId = (_a = req
@@ -63,6 +88,14 @@ export default class UserPushAPI extends BaseAPI {
                 userPush.deviceType = req.body.deviceType;
                 userPush.deviceName = req.body.deviceName || "Unknown Device";
                 userPush.isVerified = true; // Web, iOS, and Android devices are verified immediately
+                /*
+                 * The mobile app sends this when the responder already had critical
+                 * alerts on and the device is re-registering (a reinstall, a new push
+                 * token, a second project). Absent, it stays off: overriding a
+                 * silenced phone is never something a registration turns on by
+                 * itself.
+                 */
+                userPush.isCriticalAlertEnabled = parseCriticalAlertFlag(req.body.isCriticalAlertEnabled);
                 const savedDevice = await this.service.create({
                     data: userPush,
                     props: {
@@ -139,6 +172,7 @@ export default class UserPushAPI extends BaseAPI {
                         deviceType: true,
                         isVerified: true,
                         projectId: true,
+                        isCriticalAlertEnabled: true,
                     },
                 });
                 if (!device) {
@@ -153,13 +187,27 @@ export default class UserPushAPI extends BaseAPI {
                 }
                 try {
                     // Send test notification
+                    const isCriticalAlert = Boolean(device.isCriticalAlertEnabled);
+                    /*
+                     * A test that behaves unlike the real page is not a test of
+                     * anything. Critical alerts are the one setting whose effect a
+                     * responder cannot check by reasoning about it - they have to
+                     * silence the phone and hear it ring - so a device with the option
+                     * on gets a test that overrides silent mode exactly as a 3am page
+                     * would.
+                     */
                     const testMessage = PushNotificationUtil.createGenericNotification({
-                        title: "Test Notification from OneUptime",
-                        body: "This is a test notification to verify your device is working correctly.",
+                        title: isCriticalAlert
+                            ? "Test Critical Alert from OneUptime"
+                            : "Test Notification from OneUptime",
+                        body: isCriticalAlert
+                            ? "This is a test critical alert. If your device is silenced or in Do Not Disturb and you heard this, on-call pages will reach you."
+                            : "This is a test notification to verify your device is working correctly.",
                         clickAction: "/dashboard",
                         tag: "test-notification",
                         requireInteraction: false,
                     });
+                    testMessage.isCriticalAlert = isCriticalAlert;
                     await PushNotificationService.sendPushNotification({
                         devices: [
                             Object.assign({ token: device.deviceToken }, (device.deviceName && {
@@ -186,6 +234,51 @@ export default class UserPushAPI extends BaseAPI {
                 return next(error);
             }
         });
+        /*
+         * Turn "ring me through silent mode" on or off for this handset.
+         *
+         * A dedicated route rather than the generic CRUD update, for the same
+         * reason verify/unverify are: UserPush grants no update permission to
+         * anybody, so every write to it passes an explicit ownership check first
+         * and then runs as root. That keeps the set of things that can change a
+         * responder's paging configuration short and readable.
+         *
+         * Keyed on the device token, like unregister and unlike verify: the mobile
+         * app knows its own push token and holds no row ids, and one phone has a
+         * row per project it is registered against.
+         */
+        this.router.post(`/user-push/critical-alerts`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            try {
+                req = req;
+                const userId = getAuthenticatedUserId(req);
+                if (!req.body.deviceToken) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("Device token is required"));
+                }
+                /*
+                 * Required rather than defaulted. A request that forgot the field
+                 * would otherwise silently turn the setting OFF, and a responder
+                 * whose pages stopped overriding Do Not Disturb has no way to notice
+                 * until the page they missed.
+                 */
+                if (req.body.isEnabled === undefined || req.body.isEnabled === null) {
+                    return Response.sendErrorResponse(req, res, new BadDataException("isEnabled is required"));
+                }
+                const isEnabled = parseCriticalAlertFlagStrict(req.body.isEnabled);
+                const updatedCount = await this.service.setCriticalAlertEnabledForDeviceToken({
+                    userId: userId,
+                    deviceToken: req.body.deviceToken,
+                    isEnabled: isEnabled,
+                });
+                return Response.sendJsonObjectResponse(req, res, {
+                    success: true,
+                    isCriticalAlertEnabled: isEnabled,
+                    devicesUpdated: updatedCount,
+                });
+            }
+            catch (error) {
+                return next(error);
+            }
+        });
         this.router.post(`/user-push/:deviceId/verify`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             var _a;
             try {

package/build/dist/Server/API/UserPushAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserPushAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserPushAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,eAEN,MAAM,6BAA6B,CAAC;AACrC,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAClF,OAAO,uBAAuB,MAAM,qCAAqC,CAAC;AAC1E,OAAO,oBAAoB,MAAM,+BAA+B,CAAC;AACjE,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAOtE,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,cAAc,MAAM,6CAA6C,CAAC;AACzE,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAG5D,SAAS,sBAAsB,CAAC,GAAmB;;IACjD,MAAM,MAAM,GAAyB,MAAC,GAAwB;SAC3D,iBAAiB,0CAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAyB,CACjC,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,OAGxC;IACC;QACE,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qBAAqB,EACrB,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CACjD,CAAC;gBACJ,CAAC;gBAED,MAAM,gBAAgB,GAAa,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACjE,IACE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU;oBACpB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAClB,8BAA8B,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7D,CACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACxB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAC/C,CAAC;gBACJ,CAAC;gBAED,wCAAwC;gBACxC,MAAM,cAAc,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBACnE,KAAK,EAAE;wBACL,MAAM,EAAE,MAAM;wBACd,SAAS,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBAC3C,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;qBAClC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;iBACF,CAAC,CAAC;gBAEH,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAClB,0DAA0D,CAC3D,CACF,CAAC;gBACJ,CAAC;gBAED,iCAAiC;gBACjC,MAAM,QAAQ,GAAa,IAAI,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,QAAQ,CAAC,SAAS,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtD,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC5C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC1C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;gBAC9D,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,yDAAyD;gBAErF,MAAM,WAAW,GAAa,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtD,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,oEAAoE;gBACpE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBAC3C,MAAM;wBACN,kBAAkB,EAAE;4BAClB,UAAU,EAAE,WAAW,CAAC,EAAG;yBAC5B;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,WAAW,CAAC,GAAI,CAAC,QAAQ,EAAE;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CACjD,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAC1B,KAAK,EAAE;wBACL,MAAM,EAAE,MAAM;wBACd,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;qBAClC;oBACD,KAAK,EAAE,GAAG;oBACV,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,kCAAkC;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,EACxC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,MAAM,MAAM,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7D,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,IAAI;wBAChB,WAAW,EAAE,IAAI;wBACjB,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,IAAI;wBAChB,SAAS,EAAE,IAAI;qBAChB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;oBACvB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAC/C,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,yBAAyB;oBACzB,MAAM,WAAW,GACf,oBAAoB,CAAC,yBAAyB,CAAC;wBAC7C,KAAK,EAAE,kCAAkC;wBACzC,IAAI,EAAE,yEAAyE;wBAC/E,WAAW,EAAE,YAAY;wBACzB,GAAG,EAAE,mBAAmB;wBACxB,kBAAkB,EAAE,KAAK;qBAC1B,CAAC,CAAC;oBAEL,MAAM,uBAAuB,CAAC,oBAAoB,CAChD;wBACE,OAAO,EAAE;4CAEL,KAAK,EAAE,MAAM,CAAC,WAAY,IACvB,CAAC,MAAM,CAAC,UAAU,IAAI;gCACvB,IAAI,EAAE,MAAM,CAAC,UAAU;6BACxB,CAAC;yBAEL;wBACD,OAAO,EAAE,WAAW;wBACpB,UAAU,EAAE,MAAM,CAAC,UAA6B;qBACjD,EACD;wBACE,WAAW,EAAE,KAAK;wBAClB,SAAS,EAAE,MAAM,CAAC,SAAU;wBAC5B,MAAM,EAAE,MAAM,CAAC,MAAO;qBACvB,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAU,EAAE,CAAC;oBACpB,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,KAAK,CAAC,OAAO,EAAE,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,qCAAqC;iBAC/C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,EAC7B,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7D,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAI;qBAChB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAExD,kEAAkE;gBAClE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACrD,MAAM;wBACN,kBAAkB,EAAE;4BAClB,UAAU,EAAE,MAAM,CAAC,EAAG;yBACvB;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+BAA+B,EAC/B,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7D,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,GAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAE1D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"UserPushAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserPushAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,eAEN,MAAM,6BAA6B,CAAC;AACrC,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAClF,OAAO,uBAAuB,MAAM,qCAAqC,CAAC;AAC1E,OAAO,oBAAoB,MAAM,+BAA+B,CAAC;AACjE,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAOtE,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,cAAc,MAAM,6CAA6C,CAAC;AACzE,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAG5D;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAmB;;IACjD,MAAM,MAAM,GAAyB,MAAC,GAAwB;SAC3D,iBAAiB,0CAAE,MAAM,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAyB,CACjC,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,OAGxC;IACC;QACE,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qBAAqB,EACrB,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CACjD,CAAC;gBACJ,CAAC;gBAED,MAAM,gBAAgB,GAAa,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACjE,IACE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU;oBACpB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAClB,8BAA8B,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7D,CACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACxB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAC/C,CAAC;gBACJ,CAAC;gBAED,wCAAwC;gBACxC,MAAM,cAAc,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBACnE,KAAK,EAAE;wBACL,MAAM,EAAE,MAAM;wBACd,SAAS,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBAC3C,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;qBAClC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;iBACF,CAAC,CAAC;gBAEH,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAClB,0DAA0D,CAC3D,CACF,CAAC;gBACJ,CAAC;gBAED,iCAAiC;gBACjC,MAAM,QAAQ,GAAa,IAAI,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,QAAQ,CAAC,SAAS,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtD,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC5C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC1C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;gBAC9D,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,yDAAyD;gBACrF;;;;;;mBAMG;gBACH,QAAQ,CAAC,sBAAsB,GAAG,sBAAsB,CACtD,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAChC,CAAC;gBAEF,MAAM,WAAW,GAAa,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtD,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,oEAAoE;gBACpE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBAC3C,MAAM;wBACN,kBAAkB,EAAE;4BAClB,UAAU,EAAE,WAAW,CAAC,EAAG;yBAC5B;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,WAAW,CAAC,GAAI,CAAC,QAAQ,EAAE;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CACjD,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAC1B,KAAK,EAAE;wBACL,MAAM,EAAE,MAAM;wBACd,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;qBAClC;oBACD,KAAK,EAAE,GAAG;oBACV,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,kCAAkC;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,EACxC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,MAAM,MAAM,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7D,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,IAAI;wBAChB,WAAW,EAAE,IAAI;wBACjB,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,IAAI;wBAChB,SAAS,EAAE,IAAI;wBACf,sBAAsB,EAAE,IAAI;qBAC7B;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;oBACvB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAC/C,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,yBAAyB;oBACzB,MAAM,eAAe,GAAY,OAAO,CACtC,MAAM,CAAC,sBAAsB,CAC9B,CAAC;oBAEF;;;;;;;uBAOG;oBACH,MAAM,WAAW,GACf,oBAAoB,CAAC,yBAAyB,CAAC;wBAC7C,KAAK,EAAE,eAAe;4BACpB,CAAC,CAAC,oCAAoC;4BACtC,CAAC,CAAC,kCAAkC;wBACtC,IAAI,EAAE,eAAe;4BACnB,CAAC,CAAC,kIAAkI;4BACpI,CAAC,CAAC,yEAAyE;wBAC7E,WAAW,EAAE,YAAY;wBACzB,GAAG,EAAE,mBAAmB;wBACxB,kBAAkB,EAAE,KAAK;qBAC1B,CAAC,CAAC;oBAEL,WAAW,CAAC,eAAe,GAAG,eAAe,CAAC;oBAE9C,MAAM,uBAAuB,CAAC,oBAAoB,CAChD;wBACE,OAAO,EAAE;4CAEL,KAAK,EAAE,MAAM,CAAC,WAAY,IACvB,CAAC,MAAM,CAAC,UAAU,IAAI;gCACvB,IAAI,EAAE,MAAM,CAAC,UAAU;6BACxB,CAAC;yBAEL;wBACD,OAAO,EAAE,WAAW;wBACpB,UAAU,EAAE,MAAM,CAAC,UAA6B;qBACjD,EACD;wBACE,WAAW,EAAE,KAAK;wBAClB,SAAS,EAAE,MAAM,CAAC,SAAU;wBAC5B,MAAM,EAAE,MAAM,CAAC,MAAO;qBACvB,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAU,EAAE,CAAC;oBACpB,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,KAAK,CAAC,OAAO,EAAE,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,qCAAqC;iBAC/C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,EAC5B,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CACjD,CAAC;gBACJ,CAAC;gBAED;;;;;mBAKG;gBACH,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBACpE,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAY,4BAA4B,CACrD,GAAG,CAAC,IAAI,CAAC,SAAS,CACnB,CAAC;gBAEF,MAAM,YAAY,GAChB,MAAM,IAAI,CAAC,OAAO,CAAC,qCAAqC,CAAC;oBACvD,MAAM,EAAE,MAAM;oBACd,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;oBACjC,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;gBAEL,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,OAAO,EAAE,IAAI;oBACb,sBAAsB,EAAE,SAAS;oBACjC,cAAc,EAAE,YAAY;iBAC7B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,EAC7B,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7D,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAI;qBAChB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAExD,kEAAkE;gBAClE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACrD,MAAM;wBACN,kBAAkB,EAAE;4BAClB,UAAU,EAAE,MAAM,CAAC,EAAG;yBACvB;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+BAA+B,EAC/B,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,MAAM,MAAM,GAAa,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAErD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7D,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBACxC,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAED,kDAAkD;gBAClD,IAAI,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,GAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAE1D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/UserSmsAPI.js

@@ -1,17 +1,35 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, { VerificationCodeRateLimitBucket, } from "../Middleware/VerificationCodeRateLimit";
 import UserSMSService from "../Services/UserSmsService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import ChannelVerification, { ChannelVerificationOutcome, } from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserSMS from "../../Models/DatabaseModels/UserSMS";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserSMSAPI extends BaseAPI {
     constructor() {
         super(UserSMS, UserSMSService);
-        this.router.post(`/user-sms/verify`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
-            var _a, _b, _c;
+        this.router.post(`/user-sms/verify`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Verify), async (req, res, next) => {
+            var _a;
             try {
                 req = req;
                 if (!req.body.itemId) {
@@ -20,45 +38,26 @@ export default class UserSMSAPI extends BaseAPI {
                 if (!req.body.code) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
                 }
-                // Check if the code matches and verify the phone number.
-                const item = await this.service.findOneById({
-                    id: req.body["itemId"],
-                    props: {
-                        isRoot: true,
-                    },
-                    select: {
-                        userId: true,
-                        projectId: true,
-                        verificationCode: true,
-                    },
-                });
-                if (!item) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
-                }
-                //check user id
-                if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
-                    ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
+                const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+                if (!userId) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));
                 }
-                if (item.verificationCode !== req.body["code"]) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
-                }
-                await this.service.updateOneById({
-                    id: item.id,
-                    props: {
-                        isRoot: true,
-                    },
-                    data: {
-                        isVerified: true,
-                    },
+                const result = await ChannelVerification.verifyCode({
+                    service: this.service,
+                    itemId: new ObjectID(req.body["itemId"].toString()),
+                    userId: userId,
+                    code: req.body["code"].toString(),
                 });
-                // Create default notification rules for this verified SMS
+                if (result.outcome !== ChannelVerificationOutcome.Verified) {
+                    return Response.sendErrorResponse(req, res, ChannelVerification.getFailureException(result.outcome));
+                }
+                /* Create default notification rules for this verified SMS number */
                 try {
                     await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod({
-                        projectId: new ObjectID(item.projectId.toString()),
-                        userId: new ObjectID(item.userId.toString()),
+                        projectId: new ObjectID(result.projectId.toString()),
+                        userId: new ObjectID(result.userId.toString()),
                         notificationMethod: {
-                            userSmsId: item.id,
+                            userSmsId: result.itemId,
                         },
                     });
                 }
@@ -71,7 +70,7 @@ export default class UserSMSAPI extends BaseAPI {
                 return next(err);
             }
         });
-        this.router.post(`/user-sms/resend-verification-code`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`/user-sms/resend-verification-code`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Resend), async (req, res, next) => {
             var _a, _b, _c;
             try {
                 req = req;
@@ -90,6 +89,11 @@ export default class UserSMSAPI extends BaseAPI {
                 if (!item) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
                 }
+                /*
+                 * A caller may only ask for a code to be sent to a row they own.
+                 * Without this the resend route is a way to make somebody else's
+                 * device ring on demand.
+                 */
                 if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
                     ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));

package/build/dist/Server/API/UserSmsAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserSmsAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserSmsAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,cAEN,MAAM,4BAA4B,CAAC;AACpC,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAOlF,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,OAAO,MAAM,qCAAqC,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAoC;IAC1E;QACE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kBAAkB,EAClB,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,yDAAyD;gBACzD,MAAM,IAAI,GAAmB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC1D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAI;wBACf,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,eAAe;gBAEf,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC/B,EAAE,EAAE,IAAI,CAAC,EAAG;oBACZ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI;qBACjB;iBACF,CAAC,CAAC;gBAEH,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC7C,kBAAkB,EAAE;4BAClB,SAAS,EAAE,IAAI,CAAC,EAAG;yBACpB;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,EACpC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAmB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC1D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"UserSmsAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserSmsAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,yBAAyB,EAAE,EAChC,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,cAEN,MAAM,4BAA4B,CAAC;AAOpC,OAAO,mBAAmB,EAAE,EAC1B,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,OAAO,MAAM,qCAAqC,CAAC;AAC1D,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAClF,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAoC;IAC1E;QACE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kBAAkB,EAClB,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;gBAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GACV,MAAM,mBAAmB,CAAC,UAAU,CAAC;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACnD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;iBAClC,CAAC,CAAC;gBAEL,IAAI,MAAM,CAAC,OAAO,KAAK,0BAA0B,CAAC,QAAQ,EAAE,CAAC;oBAC3D,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CACxD,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACrD,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC/C,kBAAkB,EAAE;4BAClB,SAAS,EAAE,MAAM,CAAC,MAAO;yBAC1B;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,EACpC,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAmB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC1D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/UserWhatsAppAPI.js

@@ -1,18 +1,36 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, { VerificationCodeRateLimitBucket, } from "../Middleware/VerificationCodeRateLimit";
 import UserWhatsAppService from "../Services/UserWhatsAppService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import ChannelVerification, { ChannelVerificationOutcome, } from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserWhatsAppAPI extends BaseAPI {
     constructor() {
         var _a, _b;
         super(UserWhatsApp, UserWhatsAppService);
-        this.router.post(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/verify`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
-            var _a, _b, _c;
+        this.router.post(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/verify`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Verify), async (req, res, next) => {
+            var _a;
             try {
                 req = req;
                 if (!req.body.itemId) {
@@ -21,47 +39,26 @@ export default class UserWhatsAppAPI extends BaseAPI {
                 if (!req.body.code) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
                 }
-                const item = await this.service.findOneById({
-                    id: req.body["itemId"],
-                    props: {
-                        isRoot: true,
-                    },
-                    select: {
-                        userId: true,
-                        projectId: true,
-                        verificationCode: true,
-                        isVerified: true,
-                    },
-                });
-                if (!item) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
-                }
-                if (item.isVerified) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("WhatsApp number already verified"));
-                }
-                if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
-                    ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
+                const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+                if (!userId) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));
                 }
-                if (item.verificationCode !== req.body["code"]) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Invalid code"));
-                }
-                await this.service.updateOneById({
-                    id: item.id,
-                    props: {
-                        isRoot: true,
-                    },
-                    data: {
-                        isVerified: true,
-                    },
+                const result = await ChannelVerification.verifyCode({
+                    service: this.service,
+                    itemId: new ObjectID(req.body["itemId"].toString()),
+                    userId: userId,
+                    code: req.body["code"].toString(),
                 });
-                // Create default notification rules for this verified WhatsApp number
+                if (result.outcome !== ChannelVerificationOutcome.Verified) {
+                    return Response.sendErrorResponse(req, res, ChannelVerification.getFailureException(result.outcome));
+                }
+                /* Create default notification rules for this verified WhatsApp number */
                 try {
                     await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod({
-                        projectId: new ObjectID(item.projectId.toString()),
-                        userId: new ObjectID(item.userId.toString()),
+                        projectId: new ObjectID(result.projectId.toString()),
+                        userId: new ObjectID(result.userId.toString()),
                         notificationMethod: {
-                            userWhatsAppId: item.id,
+                            userWhatsAppId: result.itemId,
                         },
                     });
                 }
@@ -75,7 +72,7 @@ export default class UserWhatsAppAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_b = new this.entityType()
-            .getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/resend-verification-code`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/resend-verification-code`, UserMiddleware.getUserMiddleware, VerificationCodeRateLimit.getMiddleware(VerificationCodeRateLimitBucket.Resend), async (req, res, next) => {
             var _a, _b, _c;
             try {
                 req = req;
@@ -94,6 +91,11 @@ export default class UserWhatsAppAPI extends BaseAPI {
                 if (!item) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Item not found"));
                 }
+                /*
+                 * A caller may only ask for a code to be sent to a row they own.
+                 * Without this the resend route is a way to make somebody else's
+                 * device ring on demand.
+                 */
                 if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !==
                     ((_c = (_b = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _b === void 0 ? void 0 : _b.userId) === null || _c === void 0 ? void 0 : _c.toString())) {
                     return Response.sendErrorResponse(req, res, new BadDataException("Invalid user ID"));

package/build/dist/Server/API/UserWhatsAppAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserWhatsAppAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserWhatsAppAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,mBAEN,MAAM,iCAAiC,CAAC;AACzC,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAOlF,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,YAAY,MAAM,0CAA0C,CAAC;AAEpE,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,OAG5C;IACC;;QACE,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,SAAS,EAC9D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAI;wBACf,gBAAgB,EAAE,IAAI;wBACtB,UAAU,EAAE,IAAI;qBACjB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CACzD,CAAC;gBACJ,CAAC;gBAED,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC/B,EAAE,EAAE,IAAI,CAAC,EAAG;oBACZ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI;qBACjB;iBACF,CAAC,CAAC;gBAEH,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC7C,kBAAkB,EAAE;4BAClB,cAAc,EAAE,IAAI,CAAC,EAAG;yBACzB;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,2BAA2B,EACzC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"UserWhatsAppAPI.js","sourceRoot":"","sources":["../../../../Server/API/UserWhatsAppAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,yBAAyB,EAAE,EAChC,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,mBAEN,MAAM,iCAAiC,CAAC;AAOzC,OAAO,mBAAmB,EAAE,EAC1B,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,YAAY,MAAM,0CAA0C,CAAC;AACpE,OAAO,2BAA2B,MAAM,yCAAyC,CAAC;AAClF,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,OAG5C;IACC;;QACE,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,SAAS,EAC9D,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACnB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,cAAc,CAAC,CACrC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;gBAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,GACV,MAAM,mBAAmB,CAAC,UAAU,CAAC;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACnD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;iBAClC,CAAC,CAAC;gBAEL,IAAI,MAAM,CAAC,OAAO,KAAK,0BAA0B,CAAC,QAAQ,EAAE,CAAC;oBAC3D,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CACxD,CAAC;gBACJ,CAAC;gBAED,yEAAyE;gBACzE,IAAI,CAAC;oBACH,MAAM,2BAA2B,CAAC,4CAA4C,CAC5E;wBACE,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;wBACrD,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC;wBAC/C,kBAAkB,EAAE;4BAClB,cAAc,EAAE,MAAM,CAAC,MAAO;yBAC/B;qBACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CACV,CAAC,EACD,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,2BAA2B,EACzC,cAAc,CAAC,iBAAiB,EAChC,yBAAyB,CAAC,aAAa,CACrC,+BAA+B,CAAC,MAAM,CACvC,EACD,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,GAAG,GAAG,GAAuB,CAAC;gBAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAwB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CACvC,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE;qBACvB,MAAA,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CAAuB,iBAAiB,0CAAE,MAAM,0CAAE,QAAQ,EAAE,CAAA,EAChE,CAAC;oBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CACxC,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1787142779538-MigrationName.js

@@ -0,0 +1,89 @@
+/*
+ * GHSA-5cr8-vph4-3hrf: expiry, attempt counting and resend throttling for the
+ * notification-channel verification codes.
+ *
+ * Three columns per channel table:
+ *
+ *   verificationCodeExpiresAt    NULL means there is no live code. Every row
+ *                                that exists when this runs gets NULL, which
+ *                                is read as expired — so the plaintext codes
+ *                                those rows are carrying stop being accepted
+ *                                the moment this lands, and their owners
+ *                                press "resend" once. That is the intended
+ *                                behaviour, not a side effect: those codes
+ *                                never expired and were never attempt-limited.
+ *
+ *   verificationFailedAttempts   The counter that bounds guessing. NOT NULL
+ *                                DEFAULT 0 so the atomic increment never has
+ *                                to deal with a NULL.
+ *
+ *   verificationCodeSentAt       Drives the resend cooldown. NULL on existing
+ *                                rows, which allows one immediate resend —
+ *                                correct, since the code they hold has just
+ *                                been invalidated above.
+ *
+ * The up() also SCRUBS the plaintext codes those rows are still carrying.
+ * They are already unusable by the time the scrub runs, but they are live
+ * six-digit secrets sitting in a table, its replicas and every backup taken
+ * while they were there, and the whole point of the change this migration
+ * supports is that the column holds a keyed digest and never the code.
+ */
+export class MigrationName1787142779538 {
+    constructor() {
+        this.name = "MigrationName1787142779538";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "UserCall" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserCall" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`);
+        await queryRunner.query(`ALTER TABLE "UserCall" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserEmail" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserEmail" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`);
+        await queryRunner.query(`ALTER TABLE "UserEmail" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserSMS" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserSMS" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`);
+        await queryRunner.query(`ALTER TABLE "UserSMS" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserWhatsApp" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserWhatsApp" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`);
+        await queryRunner.query(`ALTER TABLE "UserWhatsApp" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserIncomingCallNumber" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`);
+        await queryRunner.query(`ALTER TABLE "UserIncomingCallNumber" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`);
+        await queryRunner.query(`ALTER TABLE "UserIncomingCallNumber" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`);
+        /*
+         * Replace every stored plaintext code with a value nothing can hash
+         * to. Two md5s give the 64 hex characters a real digest has, using
+         * only functions core Postgres always has — gen_random_bytes would
+         * need pgcrypto, which is not a dependency this schema otherwise has.
+         *
+         * Restricted to values that look like a code rather than applied
+         * blindly, so re-running against a database that has already moved on
+         * cannot damage a real digest.
+         */
+        for (const tableName of [
+            "UserEmail",
+            "UserSMS",
+            "UserCall",
+            "UserWhatsApp",
+            "UserIncomingCallNumber",
+        ]) {
+            await queryRunner.query(`UPDATE "${tableName}" SET "verificationCode" = md5(random()::text || clock_timestamp()::text) || md5(random()::text || clock_timestamp()::text) WHERE "verificationCode" ~ '^[0-9]{1,10}$'`);
+        }
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "UserIncomingCallNumber" DROP COLUMN "verificationCodeSentAt"`);
+        await queryRunner.query(`ALTER TABLE "UserIncomingCallNumber" DROP COLUMN "verificationFailedAttempts"`);
+        await queryRunner.query(`ALTER TABLE "UserIncomingCallNumber" DROP COLUMN "verificationCodeExpiresAt"`);
+        await queryRunner.query(`ALTER TABLE "UserWhatsApp" DROP COLUMN "verificationCodeSentAt"`);
+        await queryRunner.query(`ALTER TABLE "UserWhatsApp" DROP COLUMN "verificationFailedAttempts"`);
+        await queryRunner.query(`ALTER TABLE "UserWhatsApp" DROP COLUMN "verificationCodeExpiresAt"`);
+        await queryRunner.query(`ALTER TABLE "UserSMS" DROP COLUMN "verificationCodeSentAt"`);
+        await queryRunner.query(`ALTER TABLE "UserSMS" DROP COLUMN "verificationFailedAttempts"`);
+        await queryRunner.query(`ALTER TABLE "UserSMS" DROP COLUMN "verificationCodeExpiresAt"`);
+        await queryRunner.query(`ALTER TABLE "UserEmail" DROP COLUMN "verificationCodeSentAt"`);
+        await queryRunner.query(`ALTER TABLE "UserEmail" DROP COLUMN "verificationFailedAttempts"`);
+        await queryRunner.query(`ALTER TABLE "UserEmail" DROP COLUMN "verificationCodeExpiresAt"`);
+        await queryRunner.query(`ALTER TABLE "UserCall" DROP COLUMN "verificationCodeSentAt"`);
+        await queryRunner.query(`ALTER TABLE "UserCall" DROP COLUMN "verificationFailedAttempts"`);
+        await queryRunner.query(`ALTER TABLE "UserCall" DROP COLUMN "verificationCodeExpiresAt"`);
+    }
+}
+//# sourceMappingURL=1787142779538-MigrationName.js.map

package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1787142779538-MigrationName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"1787142779538-MigrationName.js","sourceRoot":"","sources":["../../../../../../Server/Infrastructure/Postgres/SchemaMigrations/1787142779538-MigrationName.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,OAAO,0BAA0B;IAAvC;QACS,SAAI,GAAW,4BAA4B,CAAC;IAuHrD,CAAC;IArHQ,KAAK,CAAC,EAAE,CAAC,WAAwB;QACtC,MAAM,WAAW,CAAC,KAAK,CACrB,iFAAiF,CAClF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,sFAAsF,CACvF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,8EAA8E,CAC/E,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,kFAAkF,CACnF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,uFAAuF,CACxF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,+EAA+E,CAChF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,gFAAgF,CACjF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,qFAAqF,CACtF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,6EAA6E,CAC9E,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,qFAAqF,CACtF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,0FAA0F,CAC3F,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,kFAAkF,CACnF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,+FAA+F,CAChG,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,oGAAoG,CACrG,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,4FAA4F,CAC7F,CAAC;QAEF;;;;;;;;;WASG;QACH,KAAK,MAAM,SAAS,IAAI;YACtB,WAAW;YACX,SAAS;YACT,UAAU;YACV,cAAc;YACd,wBAAwB;SACzB,EAAE,CAAC;YACF,MAAM,WAAW,CAAC,KAAK,CACrB,WAAW,SAAS,wKAAwK,CAC7L,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAAwB;QACxC,MAAM,WAAW,CAAC,KAAK,CACrB,2EAA2E,CAC5E,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,+EAA+E,CAChF,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,8EAA8E,CAC/E,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,iEAAiE,CAClE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,qEAAqE,CACtE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,oEAAoE,CACrE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,4DAA4D,CAC7D,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,gEAAgE,CACjE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,+DAA+D,CAChE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,8DAA8D,CAC/D,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,kEAAkE,CACnE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,iEAAiE,CAClE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,6DAA6D,CAC9D,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,iEAAiE,CAClE,CAAC;QACF,MAAM,WAAW,CAAC,KAAK,CACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1787156982416-MigrationName.js

@@ -0,0 +1,12 @@
+export class MigrationName1787156982416 {
+    constructor() {
+        this.name = "MigrationName1787156982416";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "UserPush" ADD "isCriticalAlertEnabled" boolean NOT NULL DEFAULT false`);
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "UserPush" DROP COLUMN "isCriticalAlertEnabled"`);
+    }
+}
+//# sourceMappingURL=1787156982416-MigrationName.js.map

package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1787156982416-MigrationName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"1787156982416-MigrationName.js","sourceRoot":"","sources":["../../../../../../Server/Infrastructure/Postgres/SchemaMigrations/1787156982416-MigrationName.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,0BAA0B;IAAvC;QACS,SAAI,GAAG,4BAA4B,CAAC;IAa7C,CAAC;IAXQ,KAAK,CAAC,EAAE,CAAC,WAAwB;QACtC,MAAM,WAAW,CAAC,KAAK,CACrB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAAwB;QACxC,MAAM,WAAW,CAAC,KAAK,CACrB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;CACF"}