@rakun-kit/core 1.4.11 → 1.5.1

package/dist/esm/api/routes/manager/auth/passwordRecovery.js

@@ -0,0 +1,142 @@
+import { createHash, randomBytes } from 'crypto';
+import { ManagerUser, PasswordResetToken, Session, } from '../../../../internal-content-types/index.js';
+import { getRakunBootstrapOptions } from '../../../../bootstrapState.js';
+import { Logger } from '../../../../lib/Logger.js';
+import { throwAppError } from '../../../../lib/errors/index.js';
+import { getMailService, hasMailService } from '../../../../mail/index.js';
+import { getMongoService } from '../../../../orm/index.js';
+import { assertAuthRateLimit, getRequestRateLimitIdentifier, } from '../../../utils/authRateLimit.js';
+import { PASSWORD_RESET_DEFAULT_EXPIRES_IN_MS } from '../../../../auth/accountRecovery.js';
+import { passwordResetMailTemplate } from '../../../../auth/passwordResetMailTemplate.js';
+import { recordAuthEvent } from '../../../utils/authEvents.js';
+const hashToken = (token) => createHash('sha256').update(token).digest('hex');
+const requirePasswordResetConfig = () => {
+    const config = getRakunBootstrapOptions()?.accountRecovery?.passwordReset;
+    if (!config || !hasMailService()) {
+        throwAppError('FEATURE_UNSUPPORTED', {
+            feature: 'accountRecovery',
+            message: 'Account recovery requires mail and accountRecovery.passwordReset configuration',
+        });
+    }
+    return config;
+};
+export const requestPasswordResetHandler = async ({ input, ctx, }) => {
+    const config = requirePasswordResetConfig();
+    const db = await getMongoService();
+    const email = input.email.trim().toLowerCase();
+    assertAuthRateLimit({
+        key: `password-reset:request:${getRequestRateLimitIdentifier(ctx)}:${email}`,
+        limit: 5,
+        windowMs: 60 * 60 * 1000,
+    });
+    const user = await db.find(ManagerUser, { email });
+    if (!user)
+        return { ok: true };
+    await db.updateMany(PasswordResetToken, {
+        'user._id': user._id,
+        consumedAt: null,
+    }, { consumedAt: new Date() }, { reason: 'password reset token superseded' });
+    const token = randomBytes(32).toString('base64url');
+    const expiresAt = new Date(Date.now() +
+        (config.expiresInMs ?? PASSWORD_RESET_DEFAULT_EXPIRES_IN_MS));
+    await db.create(PasswordResetToken, {
+        tokenHash: hashToken(token),
+        user: {
+            _id: user._id,
+            contentType: ManagerUser.name,
+            type: 'existing',
+        },
+        expiresAt,
+        _type: 'PasswordResetToken',
+    }, { reason: 'password reset requested' });
+    await recordAuthEvent({
+        type: 'auth.password-reset.requested',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'anonymous' },
+        resource: { type: 'ManagerUser', id: String(user._id) },
+        tags: ['password-reset'],
+        data: { expiresAt: expiresAt.toISOString() },
+    });
+    try {
+        const props = {
+            expiresAt,
+            resetUrl: config.createUrl(token),
+            user: {
+                email: user.email,
+                ...(user.name ? { name: user.name } : {}),
+            },
+        };
+        const template = config.template ?? passwordResetMailTemplate;
+        const subject = typeof template.subject === 'function'
+            ? await template.subject(props)
+            : template.subject;
+        const content = await template.render(props);
+        await getMailService().send({
+            to: user.email,
+            subject,
+            ...content,
+            event: {
+                template: 'password-reset',
+                source: '@rakun-kit/core/account-recovery',
+                tags: ['auth', 'account-recovery'],
+            },
+        });
+    }
+    catch (error) {
+        Logger?.error?.('Password reset mail could not be sent', {
+            errorName: error instanceof Error ? error.name : 'UnknownError',
+        });
+    }
+    return { ok: true };
+};
+export const resetPasswordHandler = async ({ input, ctx, }) => {
+    requirePasswordResetConfig();
+    const db = await getMongoService();
+    const tokenHash = hashToken(input.token);
+    assertAuthRateLimit({
+        key: `password-reset:consume:${getRequestRateLimitIdentifier(ctx)}:${tokenHash}`,
+        limit: 8,
+        windowMs: 15 * 60 * 1000,
+    });
+    const record = await db.find(PasswordResetToken, { tokenHash });
+    if (!record ||
+        record.consumedAt ||
+        new Date(record.expiresAt).getTime() <= Date.now()) {
+        throwAppError('CONFLICT', {
+            key: 'INVALID_PASSWORD_RESET_TOKEN',
+            message: 'Password reset token is invalid or expired',
+        });
+    }
+    const claimed = await db.updateMany(PasswordResetToken, {
+        tokenHash,
+        consumedAt: null,
+    }, { consumedAt: new Date() }, { reason: 'password reset token consumed' });
+    if (claimed.updatedCount !== 1) {
+        throwAppError('CONFLICT', {
+            key: 'INVALID_PASSWORD_RESET_TOKEN',
+            message: 'Password reset token is invalid or expired',
+        });
+    }
+    const userId = record.user._id;
+    await db.update(ManagerUser, userId, { password: input.password }, { reason: 'password reset' });
+    await db.delete(Session, { 'user._id': userId }, { reason: 'password reset invalidated sessions' });
+    await db.updateMany(PasswordResetToken, {
+        'user._id': userId,
+        consumedAt: null,
+    }, { consumedAt: new Date() }, { reason: 'password reset completed' });
+    await recordAuthEvent({
+        type: 'auth.password-reset.completed',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'anonymous' },
+        resource: { type: 'ManagerUser', id: String(userId) },
+        tags: ['password-reset'],
+        data: {
+            sessionsInvalidated: true,
+            mfaPreserved: true,
+        },
+    });
+    return { ok: true };
+};
+//# sourceMappingURL=passwordRecovery.js.map

package/dist/esm/api/routes/manager/auth/passwordRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordRecovery.js","sourceRoot":"","sources":["../../../../../../src/api/routes/manager/auth/passwordRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEhD,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,OAAO,GACR,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAMjD,OAAO,EACL,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAA;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAElD,MAAM,0BAA0B,GAAG,GAAG,EAAE;IACtC,MAAM,MAAM,GAAG,wBAAwB,EAAE,EAAE,eAAe,EAAE,aAAa,CAAA;IAEzE,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,aAAa,CAAC,qBAAqB,EAAE;YACnC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EACL,gFAAgF;SACnF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAAE,EAChD,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAA;IAC3C,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAE9C,mBAAmB,CAAC;QAClB,GAAG,EAAE,0BAA0B,6BAA6B,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE;QAC5E,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;KACzB,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;IAEvC,MAAM,EAAE,CAAC,UAAU,CACjB,kBAAkB,EAClB;QACE,UAAU,EAAE,IAAI,CAAC,GAAG;QACpB,UAAU,EAAE,IAAI;KACR,EACV,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAC1B,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAC9C,CAAA;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE;QACR,CAAC,MAAM,CAAC,WAAW,IAAI,oCAAoC,CAAC,CAC/D,CAAA;IAED,MAAM,EAAE,CAAC,MAAM,CACb,kBAAkB,EAClB;QACE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;QAC3B,IAAI,EAAE;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,oBAAoB;KAC5B,EACD,EAAE,MAAM,EAAE,0BAA0B,EAAE,CACvC,CAAA;IAED,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,gBAAgB,CAAC;QACxB,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE;KAC7C,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG;YACZ,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE;gBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,yBAAyB,CAAA;QAC7D,MAAM,OAAO,GACX,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU;YACpC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAA;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE5C,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO;YACP,GAAG,OAAO;YACV,KAAK,EAAE;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,kCAAkC;gBAC1C,IAAI,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC;aACnC;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,KAAK,EAAE,CAAC,uCAAuC,EAAE;YACvD,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;SAChE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,EACzC,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,0BAA0B,EAAE,CAAA;IAC5B,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAExC,mBAAmB,CAAC;QAClB,GAAG,EAAE,0BAA0B,6BAA6B,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE;QAChF,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;KACzB,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,IACE,CAAC,MAAM;QACP,MAAM,CAAC,UAAU;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAClD,CAAC;QACD,aAAa,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,8BAA8B;YACnC,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CACjC,kBAAkB,EAClB;QACE,SAAS;QACT,UAAU,EAAE,IAAI;KACR,EACV,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAC1B,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAC5C,CAAA;IAED,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,8BAA8B;YACnC,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAA;IAC9B,MAAM,EAAE,CAAC,MAAM,CACb,WAAW,EACX,MAAM,EACN,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC5B,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAC7B,CAAA;IACD,MAAM,EAAE,CAAC,MAAM,CACb,OAAO,EACP,EAAE,UAAU,EAAE,MAAM,EAAE,EACtB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAClD,CAAA;IACD,MAAM,EAAE,CAAC,UAAU,CACjB,kBAAkB,EAClB;QACE,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,IAAI;KACR,EACV,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAC1B,EAAE,MAAM,EAAE,0BAA0B,EAAE,CACvC,CAAA;IAED,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QACrD,IAAI,EAAE,CAAC,gBAAgB,CAAC;QACxB,IAAI,EAAE;YACJ,mBAAmB,EAAE,IAAI;YACzB,YAAY,EAAE,IAAI;SACnB;KACF,CAAC,CAAA;IAEF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;AAC9B,CAAC,CAAA"}

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.d.ts

@@ -4,6 +4,7 @@ export declare const confirmTotpHandler: ({ input, ctx, }: {
     input: ConfirmTotpInput;
     ctx: RakunRequestContext;
 }) => Promise<{
-    ok: boolean;
+    ok: true;
+    recoveryCodes: string[];
 }>;
 //# sourceMappingURL=confirmTotp.d.ts.map

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confirmTotp.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAGxF,eAAO,MAAM,kBAAkB,GAAU,iBAGtC;IACD,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;EAqCA,CAAC"}
+{"version":3,"file":"confirmTotp.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAKxF,eAAO,MAAM,kBAAkB,GAAU,iBAGtC;IACD,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,mBAAmB,CAAC;CAC1B;;;EAsDA,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.js

@@ -1,6 +1,8 @@
 import { UserMfa, ManagerUser } from "../../../../../internal-content-types/index.js";
 import { getMongoService } from "../../../../../orm/index.js";
 import * as OTPAuth from "otpauth";
+import { generateRecoveryCodes } from '../../../../utils/recoveryCodes.js';
+import { recordAuthEvent } from '../../../../utils/authEvents.js';
 export const confirmTotpHandler = async ({ input, ctx, }) => {
     const db = await getMongoService();
     const user = ctx.getUser();
@@ -21,16 +23,31 @@ export const confirmTotpHandler = async ({ input, ctx, }) => {
     if (delta === null) {
         throw new Error("INVALID_TOTP_CODE");
     }
+    const recovery = generateRecoveryCodes();
     await db.update(UserMfa, mfa._id, {
         enabled: true,
         preferredMethod: "totp",
         totpSecret: mfa.totpSecretPending,
         totpSecretPending: null,
         totpVerifiedAt: new Date(),
-    });
+        recoveryCodeHashes: recovery.hashes,
+        recoveryCodesGeneratedAt: new Date(),
+    }, { reason: 'mfa totp enabled' });
     await db.update(ManagerUser, user._id, {
         twoFactorEnabled: true,
+    }, { reason: 'mfa-state-sync' });
+    await recordAuthEvent({
+        type: 'auth.mfa.enabled',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'manager-user', id: String(user._id) },
+        resource: { type: 'ManagerUser', id: String(user._id) },
+        tags: ['mfa', 'totp'],
+        data: {
+            method: 'totp',
+            recoveryCodeCount: recovery.codes.length,
+        },
     });
-    return { ok: true };
+    return { ok: true, recoveryCodes: recovery.codes };
 };
 //# sourceMappingURL=confirmTotp.js.map

package/dist/esm/api/routes/manager/auth/totp/confirmTotp.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirmTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,MAAM;QACvB,UAAU,EAAE,GAAG,CAAC,iBAAiB;QACjC,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,IAAI,IAAI,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC"}
+{"version":3,"file":"confirmTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/confirmTotp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,KAAK,EACL,GAAG,GAIJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;IAExC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,MAAM;QACvB,UAAU,EAAE,GAAG,CAAC,iBAAiB;QACjC,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,IAAI,IAAI,EAAE;QAC1B,kBAAkB,EAAE,QAAQ,CAAC,MAAM;QACnC,wBAAwB,EAAE,IAAI,IAAI,EAAE;KACrC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEnC,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,gBAAgB,EAAE,IAAI;KACvB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEjC,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;SACzC;KACF,CAAC,CAAA;IAEF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/totp/enrollTotp.js

@@ -23,7 +23,7 @@ export const enrollTotpHandler = async ({ ctx, }) => {
             enabled: false,
             preferredMethod: "totp",
             _type: "UserMfa",
-        });
+        }, { reason: 'mfa enrollment started' });
     const bytes = randomBytes(20);
     const secret = new OTPAuth.Secret({
         buffer: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
@@ -44,7 +44,7 @@ export const enrollTotpHandler = async ({ ctx, }) => {
     });
     await db.update(UserMfa, mfa._id, {
         totpSecretPending: secret.base32,
-    });
+    }, { reason: 'mfa totp enrollment refreshed' });
     return {
         otpauthURL,
         qrDataURL,

package/dist/esm/api/routes/manager/auth/totp/enrollTotp.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrollTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/enrollTotp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,GAAG,GAGJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,GAAG;QACN,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC7B,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,WAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CACxB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACpC;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE;QACnD,oBAAoB,EAAE,GAAG;QACzB,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"enrollTotp.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/totp/enrollTotp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,GAAG,GAGJ,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,GAAG;QACN,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC7B,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,WAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,SAAS;SACjB,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CACxB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACpC;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE;QACnD,oBAAoB,EAAE,GAAG;QACzB,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;QAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM;KACjC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAEhD,OAAO;QACL,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/api/routes/manager/auth/updateAccount.d.ts

@@ -18,6 +18,7 @@ export declare const updateAccountHandler: ({ input, ctx, }: {
         _trashed?: boolean | undefined;
         _revision?: number | undefined;
         _localeVariantGroupId?: string | undefined;
+        _localeVariantName?: string | undefined;
         _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
         trashedAt?: Date | undefined;
         trashedBy?: string | undefined;
@@ -25,7 +26,6 @@ export declare const updateAccountHandler: ({ input, ctx, }: {
         updatedAt?: Date | undefined;
         createdBy?: string | undefined;
         updatedBy?: string | undefined;
-        _iteratorUnlinked?: boolean | undefined;
     };
     twoFactorEnabled: boolean;
     _type: "ManagerUser";
@@ -45,6 +45,7 @@ export declare const updateAccountHandler: ({ input, ctx, }: {
     _trashed?: boolean | undefined;
     _revision?: number | undefined;
     _localeVariantGroupId?: string | undefined;
+    _localeVariantName?: string | undefined;
     _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
     trashedAt?: Date | undefined;
     trashedBy?: string | undefined;
@@ -52,6 +53,5 @@ export declare const updateAccountHandler: ({ input, ctx, }: {
     updatedAt?: Date | undefined;
     createdBy?: string | undefined;
     updatedBy?: string | undefined;
-    _iteratorUnlinked?: boolean | undefined;
 }>;
 //# sourceMappingURL=updateAccount.d.ts.map

package/dist/esm/api/routes/manager/auth/updateTutorialPreferences.d.ts

@@ -18,6 +18,7 @@ export declare const updateTutorialPreferencesHandler: ({ input, ctx, }: {
         _trashed?: boolean | undefined;
         _revision?: number | undefined;
         _localeVariantGroupId?: string | undefined;
+        _localeVariantName?: string | undefined;
         _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
         trashedAt?: Date | undefined;
         trashedBy?: string | undefined;
@@ -25,7 +26,6 @@ export declare const updateTutorialPreferencesHandler: ({ input, ctx, }: {
         updatedAt?: Date | undefined;
         createdBy?: string | undefined;
         updatedBy?: string | undefined;
-        _iteratorUnlinked?: boolean | undefined;
     };
     twoFactorEnabled: boolean;
     _type: "ManagerUser";
@@ -45,6 +45,7 @@ export declare const updateTutorialPreferencesHandler: ({ input, ctx, }: {
     _trashed?: boolean | undefined;
     _revision?: number | undefined;
     _localeVariantGroupId?: string | undefined;
+    _localeVariantName?: string | undefined;
     _localeVariantRole?: import("zod").infer<typeof import("../../../../index.js").LocaleVariantRole> | undefined;
     trashedAt?: Date | undefined;
     trashedBy?: string | undefined;
@@ -52,7 +53,6 @@ export declare const updateTutorialPreferencesHandler: ({ input, ctx, }: {
     updatedAt?: Date | undefined;
     createdBy?: string | undefined;
     updatedBy?: string | undefined;
-    _iteratorUnlinked?: boolean | undefined;
 }>;
 export declare const createTutorialPreferencesUpdate: (input: UpdateTutorialPreferencesInput, now?: Date) => {
     tutorialsEnabled: boolean;

package/dist/esm/api/routes/manager/auth/webauthn/webauthnRegisterVerify.d.ts

@@ -8,6 +8,7 @@ export declare const webauthnRegisterVerifyHandler: ({ ctx, input, }: {
         response: RegistrationResponseJSON;
     };
 }) => Promise<{
-    ok: boolean;
+    ok: true;
+    recoveryCodes: string[];
 }>;
 //# sourceMappingURL=webauthnRegisterVerify.d.ts.map

package/dist/esm/api/routes/manager/auth/webauthn/webauthnRegisterVerify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthnRegisterVerify.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnRegisterVerify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAEzB,MAAM,wBAAwB,CAAC;AAWhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAI1D,eAAO,MAAM,6BAA6B,GAAU,iBAGjD;IACD,GAAG,EAAE,mBAAmB,CAAC;IACzB,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,wBAAwB,CAAC;KACpC,CAAC;CACH;;EA+EA,CAAC"}
+{"version":3,"file":"webauthnRegisterVerify.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnRegisterVerify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAEzB,MAAM,wBAAwB,CAAC;AAWhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM1D,eAAO,MAAM,6BAA6B,GAAU,iBAGjD;IACD,GAAG,EAAE,mBAAmB,CAAC;IACzB,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,wBAAwB,CAAC;KACpC,CAAC;CACH;;;EA4GA,CAAC"}

package/dist/esm/api/routes/manager/auth/webauthn/webauthnRegisterVerify.js

@@ -3,6 +3,8 @@ import { ORIGIN, RP_ID, toB64 } from "./share.js";
 import { WebAuthnRegChallenge, WebAuthnCredential, ManagerUser, UserMfa, } from "../../../../../internal-content-types/index.js";
 import { throwAppError } from "../../../../../lib/errors/index.js";
 import { getMongoService } from "../../../../../orm/index.js";
+import { generateRecoveryCodes } from '../../../../utils/recoveryCodes.js';
+import { recordAuthEvent } from '../../../../utils/authEvents.js';
 const toBase64URL = (buf) => buf.toString("base64url");
 export const webauthnRegisterVerifyHandler = async ({ ctx, input, }) => {
     const db = await getMongoService();
@@ -53,24 +55,51 @@ export const webauthnRegisterVerifyHandler = async ({ ctx, input, }) => {
     });
     await db.update(WebAuthnRegChallenge, reg._id, { consumedAt: new Date() });
     let mfa = await db.find(UserMfa, { "user._id": user._id });
+    const wasMfaEnabled = Boolean(mfa?.enabled);
+    const recovery = mfa?.recoveryCodeHashes?.length ? null : generateRecoveryCodes();
     if (!mfa) {
         mfa = await db.create(UserMfa, {
             user: { _id: user._id, contentType: ManagerUser.name, type: "existing" },
             enabled: true,
             preferredMethod: "webauthn",
+            recoveryCodeHashes: recovery?.hashes ?? [],
+            recoveryCodesGeneratedAt: new Date(),
             _type: "UserMfa",
-        });
+        }, { reason: 'mfa webauthn enabled' });
     }
     else {
         await db.update(UserMfa, mfa._id, {
             enabled: true,
             preferredMethod: "webauthn",
             totpSecretPending: null,
-        });
+            ...(recovery
+                ? {
+                    recoveryCodeHashes: recovery.hashes,
+                    recoveryCodesGeneratedAt: new Date(),
+                }
+                : {}),
+        }, { reason: 'mfa webauthn enabled' });
     }
     await db.update(ManagerUser, user._id, {
         twoFactorEnabled: true,
+    }, { reason: 'mfa-state-sync' });
+    await recordAuthEvent({
+        type: wasMfaEnabled
+            ? 'auth.mfa.method-registered'
+            : 'auth.mfa.enabled',
+        outcome: 'success',
+        ctx,
+        actor: { type: 'manager-user', id: String(user._id) },
+        resource: { type: 'ManagerUser', id: String(user._id) },
+        tags: ['mfa', 'webauthn'],
+        data: {
+            method: 'webauthn',
+            recoveryCodesGenerated: Boolean(recovery),
+        },
     });
-    return { ok: true };
+    return {
+        ok: true,
+        recoveryCodes: recovery?.codes ?? [],
+    };
 };
 //# sourceMappingURL=webauthnRegisterVerify.js.map

package/dist/esm/api/routes/manager/auth/webauthn/webauthnRegisterVerify.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthnRegisterVerify.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnRegisterVerify.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,OAAO,GACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,EAAE,EAClD,GAAG,EACH,KAAK,GAQN,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,aAAa,CAAC,WAAW,EAAE;YACzB,EAAE,EAAE,KAAK,CAAC,KAAK;YACf,QAAQ,EAAE,sBAAsB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1D,aAAa,CAAC,WAAW,EAAE;YACzB,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,UAAU;QAChB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IAEL,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,iBAAiB,EAAE,GAAG,CAAC,SAAS;QAChC,cAAc,EAAE,MAAM;QACtB,YAAY,EAAE,KAAK;QACnB,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;IAE5E,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,KAAK,CAAC,KAAK,GAAG,OAAO;QACrD,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;QACxE,2DAA2D;QAC3D,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACvD,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,oBAAoB;KAC5B,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAE3E,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC7B,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,UAAU;YAC3B,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC"}
+{"version":3,"file":"webauthnRegisterVerify.js","sourceRoot":"","sources":["../../../../../../../src/api/routes/manager/auth/webauthn/webauthnRegisterVerify.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,OAAO,GACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE9D,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,EAAE,EAClD,GAAG,EACH,KAAK,GAQN,EAAE,EAAE;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,aAAa,CAAC,WAAW,EAAE;YACzB,EAAE,EAAE,KAAK,CAAC,KAAK;YACf,QAAQ,EAAE,sBAAsB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1D,aAAa,CAAC,WAAW,EAAE;YACzB,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,UAAU;QAChB,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IAEL,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,iBAAiB,EAAE,GAAG,CAAC,SAAS;QAChC,cAAc,EAAE,MAAM;QACtB,YAAY,EAAE,KAAK;QACnB,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,aAAa,CAAC,UAAU,EAAE;YACxB,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;IAE5E,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,KAAK,CAAC,KAAK,GAAG,OAAO;QACrD,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;QACxE,2DAA2D;QAC3D,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACvD,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,oBAAoB;KAC5B,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAE3E,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC3C,MAAM,QAAQ,GACZ,GAAG,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAA;IAClE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC7B,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,UAAU;YAC3B,kBAAkB,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE;YAC1C,wBAAwB,EAAE,IAAI,IAAI,EAAE;YACpC,KAAK,EAAE,SAAS;SACjB,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,IAAI;YACvB,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC;oBACE,kBAAkB,EAAE,QAAQ,CAAC,MAAM;oBACnC,wBAAwB,EAAE,IAAI,IAAI,EAAE;iBACrC;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACrC,gBAAgB,EAAE,IAAI;KACvB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEjC,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,aAAa;YACjB,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,kBAAkB;QACtB,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvD,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;QACzB,IAAI,EAAE;YACJ,MAAM,EAAE,UAAU;YAClB,sBAAsB,EAAE,OAAO,CAAC,QAAQ,CAAC;SAC1C;KACF,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,aAAa,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;KACrC,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/api/routes/manager/comments.d.ts

@@ -1,4 +1,4 @@
-import type { CreateCommentInput, CreateCommentOutput, ListCommentsInput, ListCommentsOutput, ToggleCommentReactionInput, ToggleCommentReactionOutput } from "../../../schemas/manager/comments.js";
+import type { CommentReferenceInput, CreateCommentInput, CreateCommentOutput, ListCommentsInput, ListCommentsOutput, MarkCommentsReadInput, MarkCommentsReadOutput, ToggleCommentReactionInput, ToggleCommentReactionOutput, UnreadCommentsCountOutput } from "../../../schemas/manager/comments.js";
 import type { RakunRequestContext } from "../../context.js";
 export declare const listCommentsHandler: ({ input, ctx, }: {
     input: ListCommentsInput;
@@ -12,4 +12,12 @@ export declare const toggleCommentReactionHandler: ({ input, ctx, }: {
     input: ToggleCommentReactionInput;
     ctx: RakunRequestContext;
 }) => Promise<ToggleCommentReactionOutput>;
+export declare const markCommentsReadHandler: ({ input, ctx, }: {
+    input: MarkCommentsReadInput;
+    ctx: RakunRequestContext;
+}) => Promise<MarkCommentsReadOutput>;
+export declare const unreadCommentsCountHandler: ({ input, ctx, }: {
+    input: CommentReferenceInput;
+    ctx: RakunRequestContext;
+}) => Promise<UnreadCommentsCountOutput>;
 //# sourceMappingURL=comments.d.ts.map

package/dist/esm/api/routes/manager/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../../../../src/api/routes/manager/comments.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAuLzD,eAAO,MAAM,mBAAmB,GAAU,iBAGvC;IACD,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,kBAAkB,CAwB7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,iBAGxC;IACD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,mBAAmB,CAwC9B,CAAC;AAEF,eAAO,MAAM,4BAA4B,GAAU,iBAGhD;IACD,KAAK,EAAE,0BAA0B,CAAC;IAClC,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,2BAA2B,CA8CtC,CAAC"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../../../../src/api/routes/manager/comments.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGV,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,yBAAyB,EAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAuLzD,eAAO,MAAM,mBAAmB,GAAU,iBAGvC;IACD,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,kBAAkB,CA+B7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,iBAGxC;IACD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,mBAAmB,CAiF9B,CAAC;AAEF,eAAO,MAAM,4BAA4B,GAAU,iBAGhD;IACD,KAAK,EAAE,0BAA0B,CAAC;IAClC,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,2BAA2B,CA8CtC,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAAU,iBAG3C;IACD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,sBAAsB,CAgDjC,CAAC;AAEF,eAAO,MAAM,0BAA0B,GAAU,iBAG9C;IACD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,GAAG,EAAE,mBAAmB,CAAC;CAC1B,KAAG,OAAO,CAAC,yBAAyB,CAyCpC,CAAC"}

package/dist/esm/api/routes/manager/comments.js

@@ -1,21 +1,17 @@
-import { ContentComment, ManagerUser } from "../../../internal-content-types/index.js";
+import { ContentComment, ContentCommentReadState, ManagerUser, } from "../../../internal-content-types/index.js";
 import { throwAppError } from "../../../lib/errors/index.js";
 import { getMongoService } from "../../../orm/index.js";
 import { checkOwnership } from "../../utils/checkOwnership.js";
 import { requireContentType } from "../../utils/requireContentType.js";
 import { fallbackMentionUser, toMentionUser, } from "./users.js";
+import { createManagerNotification } from "../../utils/managerNotifications.js";
+import { findLatestReview, getDocumentRevisionToken, getRelationId as getReviewRelationId, } from "../../utils/reviews.js";
 const DEFAULT_COMMENT_LIMIT = 100;
 const MAX_COMMENT_LIMIT = 200;
 const REACTION_KEY_SEPARATOR = ":";
 const normalizeReactionEmoji = (emoji) => emoji.trim();
 const requireCommentableDocument = async ({ ctx, contentTypeName, documentId, }) => {
     const contentType = requireContentType(contentTypeName);
-    if (!contentType.comments) {
-        throwAppError("FEATURE_UNSUPPORTED", {
-            feature: "comments",
-            message: `Comments are not enabled for content type ${contentType.name}`,
-        });
-    }
     await checkOwnership({
         ctx,
         contentType,
@@ -115,6 +111,7 @@ export const listCommentsHandler = async ({ input, ctx, }) => {
     });
     const limit = Math.min(input.limit ?? DEFAULT_COMMENT_LIMIT, MAX_COMMENT_LIMIT);
     const db = await getMongoService();
+    const user = ctx.getUser();
     const result = await db.list(ContentComment, {
         filter: {
             contentType: input.contentType,
@@ -125,13 +122,19 @@ export const listCommentsHandler = async ({ input, ctx, }) => {
             sort: { createdAt: "asc" },
         },
     });
+    const readState = await db.find(ContentCommentReadState, {
+        "user._id": user._id,
+        contentType: input.contentType,
+        documentId: input.documentId,
+    });
     return {
         totalItems: result.totalItems,
         comments: await resolveComments(result.items),
+        lastReadCommentId: readState?.lastReadCommentId,
     };
 };
 export const createCommentHandler = async ({ input, ctx, }) => {
-    await requireCommentableDocument({
+    const contentType = await requireCommentableDocument({
         ctx,
         contentTypeName: input.contentType,
         documentId: input.documentId,
@@ -159,6 +162,38 @@ export const createCommentHandler = async ({ input, ctx, }) => {
         createdBy: user._id,
         updatedBy: user._id,
     }, { actorId: user._id });
+    const canLoadDocument = typeof db.get === "function";
+    const document = canLoadDocument
+        ? (await db.get(contentType, input.documentId))
+        : undefined;
+    const revisionToken = document
+        ? getDocumentRevisionToken(document)
+        : undefined;
+    const activeReview = revisionToken
+        ? (await findLatestReview({
+            contentType: input.contentType,
+            documentId: input.documentId,
+            revisionToken,
+        }))
+        : null;
+    const notificationKinds = new Map(mentionIds.map((id) => [id, "comment_mention"]));
+    if (activeReview &&
+        activeReview.revisionToken === revisionToken &&
+        activeReview.status === "pending") {
+        const reviewAuthorId = getReviewRelationId(activeReview.author);
+        if (reviewAuthorId)
+            notificationKinds.set(reviewAuthorId, "review_feedback");
+    }
+    await Promise.all(Array.from(notificationKinds.entries()).map(([id, kind]) => createManagerNotification({
+        userId: id,
+        authorId: user._id,
+        eventId: comment._id,
+        kind,
+        reviewId: kind === "review_feedback" ? activeReview?._id : undefined,
+        contentType: input.contentType,
+        documentId: input.documentId,
+        text: input.text.trim(),
+    })));
     const [resolved] = await resolveComments([comment]);
     return {
         comment: resolved,
@@ -200,4 +235,79 @@ export const toggleCommentReactionHandler = async ({ input, ctx, }) => {
         comment: resolved,
     };
 };
+export const markCommentsReadHandler = async ({ input, ctx, }) => {
+    await requireCommentableDocument({
+        ctx,
+        contentTypeName: input.contentType,
+        documentId: input.documentId,
+    });
+    const db = await getMongoService();
+    const user = ctx.getUser();
+    const comment = await db.find(ContentComment, {
+        _id: input.commentId,
+        contentType: input.contentType,
+        documentId: input.documentId,
+    });
+    if (!comment) {
+        throwAppError("NOT_FOUND", {
+            resource: "ContentComment",
+            id: input.commentId,
+        });
+    }
+    await db.upsert(ContentCommentReadState, {
+        "user._id": user._id,
+        contentType: input.contentType,
+        documentId: input.documentId,
+    }, {
+        _type: ContentCommentReadState.name,
+        user: {
+            type: "existing",
+            _id: user._id,
+            contentType: ManagerUser.name,
+        },
+        contentType: input.contentType,
+        documentId: input.documentId,
+        lastReadCommentId: input.commentId,
+        createdBy: user._id,
+        updatedBy: user._id,
+    }, { actorId: user._id });
+    return {
+        lastReadCommentId: input.commentId,
+    };
+};
+export const unreadCommentsCountHandler = async ({ input, ctx, }) => {
+    await requireCommentableDocument({
+        ctx,
+        contentTypeName: input.contentType,
+        documentId: input.documentId,
+    });
+    const db = await getMongoService();
+    const user = ctx.getUser();
+    const [commentsResult, readState] = await Promise.all([
+        db.list(ContentComment, {
+            filter: {
+                contentType: input.contentType,
+                documentId: input.documentId,
+            },
+            options: {
+                fields: ["author"],
+                limit: "all",
+                sort: { createdAt: "asc" },
+            },
+        }),
+        db.find(ContentCommentReadState, {
+            "user._id": user._id,
+            contentType: input.contentType,
+            documentId: input.documentId,
+        }),
+    ]);
+    const comments = commentsResult.items;
+    const lastReadIndex = readState?.lastReadCommentId
+        ? comments.findIndex((comment) => comment._id === readState.lastReadCommentId)
+        : -1;
+    const unreadComments = lastReadIndex >= 0 ? comments.slice(lastReadIndex + 1) : comments;
+    return {
+        count: unreadComments.filter((comment) => getRelationId(comment.author) !== user._id).length,
+    };
+};
 //# sourceMappingURL=comments.js.map