@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.4

package/dist/production/src/lib/tenant/clients/TenantPersonClient.cjs

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApi = require("@contember/graphql-client-tenant");
+const personsFetcher = TenantApi.query$.persons(TenantApi.person$$.identity(TenantApi.identity$.id));
+const personByIdFetcher = TenantApi.query$.personById(
+  TenantApi.person$$.identity(TenantApi.identity$.id.roles.sessions(TenantApi.sessionInfo$$)).identityProviders(TenantApi.personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(TenantApi.identityProviderListItem$$))
+);
+const signUpFetcher = TenantApi.mutation$.signUp(
+  TenantApi.signUpResponse$$.error(TenantApi.signUpError$$.weakPasswordReasons.recommendedAction).result(TenantApi.signUpResult$.person(TenantApi.person$$.identity(TenantApi.identity$.id)))
+);
+const changeProfileFetcher = TenantApi.mutation$.changeProfile(TenantApi.changeProfileResponse$$.error(TenantApi.changeProfileError$$));
+const changePasswordFetcher = TenantApi.mutation$.changePassword(TenantApi.changePasswordResponse$$.error(TenantApi.changePasswordError$$.weakPasswordReasons));
+const disablePersonFetcher = TenantApi.mutation$.disablePerson(TenantApi.disablePersonResponse$$.error(TenantApi.disablePersonError$$));
+const forceSignOutPersonFetcher = TenantApi.mutation$.forceSignOutPerson(TenantApi.forceSignOutPersonResponse$$.error(TenantApi.forceSignOutPersonError$$));
+const resetPersonMfaFetcher = TenantApi.mutation$.resetPersonMfa(TenantApi.resetPersonMfaResponse$$.error(TenantApi.resetPersonMfaError$$));
+const createResetPasswordRequestFetcher = TenantApi.mutation$.createResetPasswordRequest(
+  TenantApi.createPasswordResetRequestResponse$$.error(TenantApi.createPasswordResetRequestError$$)
+);
+const createSessionTokenFetcher = TenantApi.mutation$.createSessionToken(
+  TenantApi.createSessionTokenResponse$$.error(TenantApi.createSessionTokenError$$).result(TenantApi.createSessionTokenResult$.token.person(TenantApi.person$$.id.email.name.identity(TenantApi.identity$.id)))
+);
+const addGlobalIdentityRolesFetcher = TenantApi.mutation$.addGlobalIdentityRoles(
+  TenantApi.addGlobalIdentityRolesResponse$$.error(TenantApi.addGlobalIdentityRolesError$$).result(TenantApi.addGlobalIdentityRolesResult$.identity(TenantApi.identity$.id.roles))
+);
+const removeGlobalIdentityRolesFetcher = TenantApi.mutation$.removeGlobalIdentityRoles(
+  TenantApi.removeGlobalIdentityRolesResponse$$.error(TenantApi.removeGlobalIdentityRolesError$$).result(
+    TenantApi.removeGlobalIdentityRolesResult$.identity(TenantApi.identity$.id.roles)
+  )
+);
+const toTenantPerson = (person) => ({
+  id: person.id,
+  identityId: person.identity.id,
+  email: person.email ?? null,
+  name: person.name ?? null,
+  otpEnabled: person.otpEnabled,
+  emailOtpEnabled: person.emailOtpEnabled,
+  emailVerified: person.emailVerified
+});
+class TenantPersonClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listPersons({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(personsFetcher, { filter, limit, offset });
+    return result.persons.map((it) => ({
+      id: it.id,
+      identityId: it.identity.id,
+      email: it.email ?? null,
+      name: it.name ?? null,
+      otpEnabled: it.otpEnabled,
+      emailOtpEnabled: it.emailOtpEnabled,
+      emailVerified: it.emailVerified
+    }));
+  }
+  /** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */
+  async getPerson(id) {
+    const result = await this.transport.exec(personByIdFetcher, { id });
+    const person = result.personById;
+    if (!person) {
+      return null;
+    }
+    return {
+      ...toTenantPerson(person),
+      passwordlessEnabled: person.passwordlessEnabled ?? null,
+      roles: person.identity.roles ? [...person.identity.roles] : null,
+      sessions: person.identity.sessions.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        expiresAt: it.expiresAt ?? null,
+        lastUsedAt: it.lastUsedAt ?? null,
+        lastIp: it.lastIp ?? null,
+        lastUserAgent: it.lastUserAgent ?? null,
+        createdIp: it.createdIp ?? null,
+        createdUserAgent: it.createdUserAgent ?? null,
+        isCurrent: it.isCurrent,
+        trustForwardedClientInfo: it.trustForwardedClientInfo
+      })),
+      identityProviders: person.identityProviders.map((it) => ({
+        id: it.id,
+        slug: it.identityProvider.slug,
+        type: it.identityProvider.type,
+        externalIdentifier: it.externalIdentifier,
+        createdAt: it.createdAt
+      }))
+    };
+  }
+  /**
+   * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's
+   * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.
+   */
+  async signUp({ email, password, passwordHash, name, roles, captchaToken }) {
+    const result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken });
+    this.transport.assertOk(result.signUp, `signUp(${email})`);
+    const person = result.signUp?.result?.person;
+    if (!person) {
+      throw new cliCommon.CliError(`signUp(${email}) reported success but returned no person`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+    }
+    return toTenantPerson(person);
+  }
+  async changeProfile(personId, { email, name }) {
+    const result = await this.transport.exec(changeProfileFetcher, { personId, email, name });
+    this.transport.assertOk(result.changeProfile, `changeProfile(${personId})`);
+  }
+  async changePassword(personId, password) {
+    const result = await this.transport.exec(changePasswordFetcher, { personId, password });
+    this.transport.assertOk(result.changePassword, `changePassword(${personId})`);
+  }
+  async disablePerson(personId) {
+    const result = await this.transport.exec(disablePersonFetcher, { personId });
+    this.transport.assertOk(result.disablePerson, `disablePerson(${personId})`);
+  }
+  async forceSignOutPerson(personId, reason) {
+    const result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason });
+    this.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`);
+  }
+  async resetPersonMfa(personId) {
+    const result = await this.transport.exec(resetPersonMfaFetcher, { personId });
+    this.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`);
+  }
+  async createResetPasswordRequest(email, options, captchaToken) {
+    const result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken });
+    this.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`);
+  }
+  async createSessionToken({ email, personId, expiration, options }) {
+    const result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options });
+    this.transport.assertOk(result.createSessionToken, "createSessionToken");
+    const tokenResult = result.createSessionToken?.result;
+    if (!tokenResult) {
+      throw new cliCommon.CliError("createSessionToken reported success but returned no token.", {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+    }
+    return {
+      token: tokenResult.token,
+      personId: tokenResult.person.id,
+      identityId: tokenResult.person.identity.id,
+      email: tokenResult.person.email ?? null,
+      name: tokenResult.person.name ?? null
+    };
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async addGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async removeGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+}
+exports.TenantPersonClient = TenantPersonClient;
+//# sourceMappingURL=TenantPersonClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantPersonClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPersonClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddGlobalIdentityRolesError$$,\n\taddGlobalIdentityRolesResponse$$,\n\taddGlobalIdentityRolesResult$,\n\tchangePasswordError$$,\n\tchangePasswordResponse$$,\n\tchangeProfileError$$,\n\tchangeProfileResponse$$,\n\tcreatePasswordResetRequestError$$,\n\tcreatePasswordResetRequestResponse$$,\n\ttype CreateResetPasswordRequestOptions,\n\tcreateSessionTokenError$$,\n\tcreateSessionTokenResponse$$,\n\tcreateSessionTokenResult$,\n\tdisablePersonError$$,\n\tdisablePersonResponse$$,\n\tforceSignOutPersonError$$,\n\tforceSignOutPersonResponse$$,\n\tidentity$,\n\tidentityProviderListItem$$,\n\tmutation$,\n\tperson$$,\n\tpersonIdentityProvider$,\n\ttype PersonsFilter,\n\tquery$,\n\tremoveGlobalIdentityRolesError$$,\n\tremoveGlobalIdentityRolesResponse$$,\n\tremoveGlobalIdentityRolesResult$,\n\tresetPersonMfaError$$,\n\tresetPersonMfaResponse$$,\n\tsessionInfo$$,\n\ttype SignInOptions,\n\tsignUpError$$,\n\tsignUpResponse$$,\n\tsignUpResult$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantPerson {\n\tid: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\totpEnabled: boolean\n\temailOtpEnabled: boolean\n\temailVerified: boolean\n}\n\nexport interface TenantPersonSession {\n\tid: string\n\tcreatedAt: string\n\texpiresAt: string | null\n\tlastUsedAt: string | null\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tcreatedIp: string | null\n\tcreatedUserAgent: string | null\n\tisCurrent: boolean\n\ttrustForwardedClientInfo: boolean\n}\n\nexport interface TenantPersonIdentityProvider {\n\tid: string\n\tslug: string\n\ttype: string\n\texternalIdentifier: string\n\tcreatedAt: string\n}\n\n/**\n * Everything `personById` exposes about a single person. `roles` is null when the caller may not read\n * them, and `sessions` / `identityProviders` come back empty (never an error) for the same reason.\n */\nexport interface TenantPersonDetail extends TenantPerson {\n\tpasswordlessEnabled: boolean | null\n\troles: string[] | null\n\tsessions: TenantPersonSession[]\n\tidentityProviders: TenantPersonIdentityProvider[]\n}\n\nexport interface ListPersonsArgs {\n\tfilter?: PersonsFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface SignUpPersonArgs {\n\temail: string\n\t/** Plaintext password. Mutually exclusive with {@link passwordHash}; omit both to create a person without one. */\n\tpassword?: string\n\t/** Pre-computed bcrypt hash — the tenant API accepts `$2b$` only. */\n\tpasswordHash?: string\n\tname?: string\n\troles?: readonly string[]\n\tcaptchaToken?: string\n}\n\nexport interface CreateSessionTokenArgs {\n\temail?: string\n\tpersonId?: string\n\texpiration?: number\n\toptions?: SignInOptions\n}\n\nexport interface TenantCreatedSessionToken {\n\ttoken: string\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n}\n\nexport interface ChangeProfileArgs {\n\temail?: string\n\tname?: string\n}\n\n/** The subset of a `person$$` selection the CLI maps — an actual row carries more, which is fine. */\ninterface PersonRow {\n\treadonly id: string\n\treadonly email?: string\n\treadonly name?: string\n\treadonly otpEnabled: boolean\n\treadonly emailOtpEnabled: boolean\n\treadonly emailVerified: boolean\n\treadonly identity: { readonly id: string }\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst personsFetcher = query$.persons(person$$.identity(identity$.id))\nconst personByIdFetcher = query$.personById(\n\tperson$$\n\t\t.identity(identity$.id.roles.sessions(sessionInfo$$))\n\t\t.identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$)),\n)\nconst signUpFetcher = mutation$.signUp(\n\tsignUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id))),\n)\nconst changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$))\nconst changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons))\nconst disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$))\nconst forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$))\nconst resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$))\nconst createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(\n\tcreatePasswordResetRequestResponse$$.error(createPasswordResetRequestError$$),\n)\nconst createSessionTokenFetcher = mutation$.createSessionToken(\n\tcreateSessionTokenResponse$$\n\t\t.error(createSessionTokenError$$)\n\t\t.result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id))),\n)\nconst addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(\n\taddGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles)),\n)\nconst removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(\n\tremoveGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(\n\t\tremoveGlobalIdentityRolesResult$.identity(identity$.id.roles),\n\t),\n)\n\nconst toTenantPerson = (person: PersonRow): TenantPerson => ({\n\tid: person.id,\n\tidentityId: person.identity.id,\n\temail: person.email ?? null,\n\tname: person.name ?? null,\n\totpEnabled: person.otpEnabled,\n\temailOtpEnabled: person.emailOtpEnabled,\n\temailVerified: person.emailVerified,\n})\n\n/** Persons, their global identity roles and their sessions. */\nexport class TenantPersonClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listPersons({ filter, limit, offset }: ListPersonsArgs = {}): Promise<TenantPerson[]> {\n\t\tconst result = await this.transport.exec(personsFetcher, { filter, limit, offset })\n\t\treturn result.persons.map(it => ({\n\t\t\tid: it.id,\n\t\t\tidentityId: it.identity.id,\n\t\t\temail: it.email ?? null,\n\t\t\tname: it.name ?? null,\n\t\t\totpEnabled: it.otpEnabled,\n\t\t\temailOtpEnabled: it.emailOtpEnabled,\n\t\t\temailVerified: it.emailVerified,\n\t\t}))\n\t}\n\n\t/** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */\n\tpublic async getPerson(id: string): Promise<TenantPersonDetail | null> {\n\t\tconst result = await this.transport.exec(personByIdFetcher, { id })\n\t\tconst person = result.personById\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...toTenantPerson(person),\n\t\t\tpasswordlessEnabled: person.passwordlessEnabled ?? null,\n\t\t\troles: person.identity.roles ? [...person.identity.roles] : null,\n\t\t\tsessions: person.identity.sessions.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\texpiresAt: it.expiresAt ?? null,\n\t\t\t\tlastUsedAt: it.lastUsedAt ?? null,\n\t\t\t\tlastIp: it.lastIp ?? null,\n\t\t\t\tlastUserAgent: it.lastUserAgent ?? null,\n\t\t\t\tcreatedIp: it.createdIp ?? null,\n\t\t\t\tcreatedUserAgent: it.createdUserAgent ?? null,\n\t\t\t\tisCurrent: it.isCurrent,\n\t\t\t\ttrustForwardedClientInfo: it.trustForwardedClientInfo,\n\t\t\t})),\n\t\t\tidentityProviders: person.identityProviders.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tslug: it.identityProvider.slug,\n\t\t\t\ttype: it.identityProvider.type,\n\t\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t})),\n\t\t}\n\t}\n\n\t/**\n\t * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's\n\t * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.\n\t */\n\tpublic async signUp({ email, password, passwordHash, name, roles, captchaToken }: SignUpPersonArgs): Promise<TenantPerson> {\n\t\tconst result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken })\n\t\tthis.transport.assertOk(result.signUp, `signUp(${email})`)\n\t\tconst person = result.signUp?.result?.person\n\t\tif (!person) {\n\t\t\tthrow new CliError(`signUp(${email}) reported success but returned no person`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn toTenantPerson(person)\n\t}\n\n\tpublic async changeProfile(personId: string, { email, name }: ChangeProfileArgs): Promise<void> {\n\t\tconst result = await this.transport.exec(changeProfileFetcher, { personId, email, name })\n\t\tthis.transport.assertOk(result.changeProfile, `changeProfile(${personId})`)\n\t}\n\n\tpublic async changePassword(personId: string, password: string): Promise<void> {\n\t\tconst result = await this.transport.exec(changePasswordFetcher, { personId, password })\n\t\tthis.transport.assertOk(result.changePassword, `changePassword(${personId})`)\n\t}\n\n\tpublic async disablePerson(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disablePersonFetcher, { personId })\n\t\tthis.transport.assertOk(result.disablePerson, `disablePerson(${personId})`)\n\t}\n\n\tpublic async forceSignOutPerson(personId: string, reason?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason })\n\t\tthis.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`)\n\t}\n\n\tpublic async resetPersonMfa(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(resetPersonMfaFetcher, { personId })\n\t\tthis.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`)\n\t}\n\n\tpublic async createResetPasswordRequest(email: string, options?: CreateResetPasswordRequestOptions, captchaToken?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken })\n\t\tthis.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`)\n\t}\n\n\tpublic async createSessionToken({ email, personId, expiration, options }: CreateSessionTokenArgs): Promise<TenantCreatedSessionToken> {\n\t\tconst result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options })\n\t\tthis.transport.assertOk(result.createSessionToken, 'createSessionToken')\n\t\tconst tokenResult = result.createSessionToken?.result\n\t\tif (!tokenResult) {\n\t\t\tthrow new CliError('createSessionToken reported success but returned no token.', {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\ttoken: tokenResult.token,\n\t\t\tpersonId: tokenResult.person.id,\n\t\t\tidentityId: tokenResult.person.identity.id,\n\t\t\temail: tokenResult.person.email ?? null,\n\t\t\tname: tokenResult.person.name ?? null,\n\t\t}\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async addGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async removeGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n}\n"],"names":["query$","person$$","identity$","sessionInfo$$","personIdentityProvider$","identityProviderListItem$$","mutation$","signUpResponse$$","signUpError$$","signUpResult$","changeProfileResponse$$","changeProfileError$$","changePasswordResponse$$","changePasswordError$$","disablePersonResponse$$","disablePersonError$$","forceSignOutPersonResponse$$","forceSignOutPersonError$$","resetPersonMfaResponse$$","resetPersonMfaError$$","createPasswordResetRequestResponse$$","createPasswordResetRequestError$$","createSessionTokenResponse$$","createSessionTokenError$$","createSessionTokenResult$","addGlobalIdentityRolesResponse$$","addGlobalIdentityRolesError$$","addGlobalIdentityRolesResult$","removeGlobalIdentityRolesResponse$$","removeGlobalIdentityRolesError$$","removeGlobalIdentityRolesResult$","CliError","ExitCode"],"mappings":";;;;AAkIA,MAAM,iBAAiBA,UAAAA,OAAO,QAAQC,UAAAA,SAAS,SAASC,UAAAA,UAAU,EAAE,CAAC;AACrE,MAAM,oBAAoBF,UAAAA,OAAO;AAAA,EAChCC,UAAAA,SACE,SAASC,UAAAA,UAAU,GAAG,MAAM,SAASC,UAAAA,aAAa,CAAC,EACnD,kBAAkBC,UAAAA,wBAAwB,GAAG,UAAU,mBAAmB,iBAAiBC,oCAA0B,CAAC;AACzH;AACA,MAAM,gBAAgBC,UAAAA,UAAU;AAAA,EAC/BC,UAAAA,iBAAiB,MAAMC,UAAAA,cAAc,oBAAoB,iBAAiB,EAAE,OAAOC,UAAAA,cAAc,OAAOR,UAAAA,SAAS,SAASC,UAAAA,UAAU,EAAE,CAAC,CAAC;AACzI;AACA,MAAM,uBAAuBI,UAAAA,UAAU,cAAcI,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AACxG,MAAM,wBAAwBL,UAAAA,UAAU,eAAeM,UAAAA,yBAAyB,MAAMC,UAAAA,sBAAsB,mBAAmB,CAAC;AAChI,MAAM,uBAAuBP,UAAAA,UAAU,cAAcQ,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AACxG,MAAM,4BAA4BT,UAAAA,UAAU,mBAAmBU,UAAAA,6BAA6B,MAAMC,UAAAA,yBAAyB,CAAC;AAC5H,MAAM,wBAAwBX,UAAAA,UAAU,eAAeY,UAAAA,yBAAyB,MAAMC,UAAAA,qBAAqB,CAAC;AAC5G,MAAM,oCAAoCb,UAAAA,UAAU;AAAA,EACnDc,UAAAA,qCAAqC,MAAMC,UAAAA,iCAAiC;AAC7E;AACA,MAAM,4BAA4Bf,UAAAA,UAAU;AAAA,EAC3CgB,UAAAA,6BACE,MAAMC,UAAAA,yBAAyB,EAC/B,OAAOC,UAAAA,0BAA0B,MAAM,OAAOvB,UAAAA,SAAS,GAAG,MAAM,KAAK,SAASC,UAAAA,UAAU,EAAE,CAAC,CAAC;AAC/F;AACA,MAAM,gCAAgCI,UAAAA,UAAU;AAAA,EAC/CmB,2CAAiC,MAAMC,UAAAA,6BAA6B,EAAE,OAAOC,UAAAA,8BAA8B,SAASzB,UAAAA,UAAU,GAAG,KAAK,CAAC;AACxI;AACA,MAAM,mCAAmCI,UAAAA,UAAU;AAAA,EAClDsB,8CAAoC,MAAMC,UAAAA,gCAAgC,EAAE;AAAA,IAC3EC,UAAAA,iCAAiC,SAAS5B,oBAAU,GAAG,KAAK;AAAA,EAAA;AAE9D;AAEA,MAAM,iBAAiB,CAAC,YAAqC;AAAA,EAC5D,IAAI,OAAO;AAAA,EACX,YAAY,OAAO,SAAS;AAAA,EAC5B,OAAO,OAAO,SAAS;AAAA,EACvB,MAAM,OAAO,QAAQ;AAAA,EACrB,YAAY,OAAO;AAAA,EACnB,iBAAiB,OAAO;AAAA,EACxB,eAAe,OAAO;AACvB;AAGO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAA6B;AAClG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO,OAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MAChC,IAAI,GAAG;AAAA,MACP,YAAY,GAAG,SAAS;AAAA,MACxB,OAAO,GAAG,SAAS;AAAA,MACnB,MAAM,GAAG,QAAQ;AAAA,MACjB,YAAY,GAAG;AAAA,MACf,iBAAiB,GAAG;AAAA,MACpB,eAAe,GAAG;AAAA,IAAA,EACjB;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,UAAU,IAAgD;AACtE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,IAAI;AAClE,UAAM,SAAS,OAAO;AACtB,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,eAAe,MAAM;AAAA,MACxB,qBAAqB,OAAO,uBAAuB;AAAA,MACnD,OAAO,OAAO,SAAS,QAAQ,CAAC,GAAG,OAAO,SAAS,KAAK,IAAI;AAAA,MAC5D,UAAU,OAAO,SAAS,SAAS,IAAI,CAAA,QAAO;AAAA,QAC7C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,WAAW,GAAG,aAAa;AAAA,QAC3B,YAAY,GAAG,cAAc;AAAA,QAC7B,QAAQ,GAAG,UAAU;AAAA,QACrB,eAAe,GAAG,iBAAiB;AAAA,QACnC,WAAW,GAAG,aAAa;AAAA,QAC3B,kBAAkB,GAAG,oBAAoB;AAAA,QACzC,WAAW,GAAG;AAAA,QACd,0BAA0B,GAAG;AAAA,MAAA,EAC5B;AAAA,MACF,mBAAmB,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,QACtD,IAAI,GAAG;AAAA,QACP,MAAM,GAAG,iBAAiB;AAAA,QAC1B,MAAM,GAAG,iBAAiB;AAAA,QAC1B,oBAAoB,GAAG;AAAA,QACvB,WAAW,GAAG;AAAA,MAAA,EACb;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAO,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,gBAAyD;AAC1H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,cAAc;AACpH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,KAAK,GAAG;AACzD,UAAM,SAAS,OAAO,QAAQ,QAAQ;AACtC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI6B,UAAAA,SAAS,UAAU,KAAK,6CAA6C;AAAA,QAC9E,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO,eAAe,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAa,cAAc,UAAkB,EAAE,OAAO,QAA0C;AAC/F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU,OAAO,MAAM;AACxF,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,eAAe,UAAkB,UAAiC;AAC9E,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU,UAAU;AACtF,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,cAAc,UAAiC;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU;AAC3E,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,mBAAmB,UAAkB,QAAgC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,UAAU,QAAQ;AACxF,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,QAAQ,GAAG;AAAA,EACrF;AAAA,EAEA,MAAa,eAAe,UAAiC;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU;AAC5E,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,2BAA2B,OAAe,SAA6C,cAAsC;AACzI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mCAAmC,EAAE,OAAO,SAAS,cAAc;AAC5G,SAAK,UAAU,SAAS,OAAO,4BAA4B,8BAA8B,KAAK,GAAG;AAAA,EAClG;AAAA,EAEA,MAAa,mBAAmB,EAAE,OAAO,UAAU,YAAY,WAAuE;AACrI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,OAAO,UAAU,YAAY,QAAA,CAAS;AAC5G,SAAK,UAAU,SAAS,OAAO,oBAAoB,oBAAoB;AACvE,UAAM,cAAc,OAAO,oBAAoB;AAC/C,QAAI,CAAC,aAAa;AACjB,YAAM,IAAID,UAAAA,SAAS,8DAA8D;AAAA,QAChF,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,MACN,OAAO,YAAY;AAAA,MACnB,UAAU,YAAY,OAAO;AAAA,MAC7B,YAAY,YAAY,OAAO,SAAS;AAAA,MACxC,OAAO,YAAY,OAAO,SAAS;AAAA,MACnC,MAAM,YAAY,OAAO,QAAQ;AAAA,IAAA;AAAA,EAEnC;AAAA;AAAA,EAGA,MAAa,uBAAuB,YAAoB,OAAoD;AAC3G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,+BAA+B,EAAE,YAAY,OAAO;AAC7F,SAAK,UAAU,SAAS,OAAO,wBAAwB,0BAA0B,UAAU,GAAG;AAC9F,UAAM,cAAc,OAAO,wBAAwB,QAAQ,SAAS;AACpE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AAAA;AAAA,EAGA,MAAa,0BAA0B,YAAoB,OAAoD;AAC9G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kCAAkC,EAAE,YAAY,OAAO;AAChG,SAAK,UAAU,SAAS,OAAO,2BAA2B,6BAA6B,UAAU,GAAG;AACpG,UAAM,cAAc,OAAO,2BAA2B,QAAQ,SAAS;AACvE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AACD;;"}

package/dist/production/src/lib/tenant/clients/TenantPersonClient.js

@@ -0,0 +1,162 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { query$, person$$, identity$, sessionInfo$$, personIdentityProvider$, identityProviderListItem$$, mutation$, signUpResponse$$, signUpError$$, signUpResult$, changeProfileResponse$$, changeProfileError$$, changePasswordResponse$$, changePasswordError$$, disablePersonResponse$$, disablePersonError$$, forceSignOutPersonResponse$$, forceSignOutPersonError$$, resetPersonMfaResponse$$, resetPersonMfaError$$, createPasswordResetRequestResponse$$, createPasswordResetRequestError$$, createSessionTokenResponse$$, createSessionTokenError$$, createSessionTokenResult$, addGlobalIdentityRolesResponse$$, addGlobalIdentityRolesError$$, addGlobalIdentityRolesResult$, removeGlobalIdentityRolesResponse$$, removeGlobalIdentityRolesError$$, removeGlobalIdentityRolesResult$ } from "@contember/graphql-client-tenant";
+const personsFetcher = query$.persons(person$$.identity(identity$.id));
+const personByIdFetcher = query$.personById(
+  person$$.identity(identity$.id.roles.sessions(sessionInfo$$)).identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$))
+);
+const signUpFetcher = mutation$.signUp(
+  signUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id)))
+);
+const changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$));
+const changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons));
+const disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$));
+const forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$));
+const resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$));
+const createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(
+  createPasswordResetRequestResponse$$.error(createPasswordResetRequestError$$)
+);
+const createSessionTokenFetcher = mutation$.createSessionToken(
+  createSessionTokenResponse$$.error(createSessionTokenError$$).result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id)))
+);
+const addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(
+  addGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles))
+);
+const removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(
+  removeGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(
+    removeGlobalIdentityRolesResult$.identity(identity$.id.roles)
+  )
+);
+const toTenantPerson = (person) => ({
+  id: person.id,
+  identityId: person.identity.id,
+  email: person.email ?? null,
+  name: person.name ?? null,
+  otpEnabled: person.otpEnabled,
+  emailOtpEnabled: person.emailOtpEnabled,
+  emailVerified: person.emailVerified
+});
+class TenantPersonClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listPersons({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(personsFetcher, { filter, limit, offset });
+    return result.persons.map((it) => ({
+      id: it.id,
+      identityId: it.identity.id,
+      email: it.email ?? null,
+      name: it.name ?? null,
+      otpEnabled: it.otpEnabled,
+      emailOtpEnabled: it.emailOtpEnabled,
+      emailVerified: it.emailVerified
+    }));
+  }
+  /** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */
+  async getPerson(id) {
+    const result = await this.transport.exec(personByIdFetcher, { id });
+    const person = result.personById;
+    if (!person) {
+      return null;
+    }
+    return {
+      ...toTenantPerson(person),
+      passwordlessEnabled: person.passwordlessEnabled ?? null,
+      roles: person.identity.roles ? [...person.identity.roles] : null,
+      sessions: person.identity.sessions.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        expiresAt: it.expiresAt ?? null,
+        lastUsedAt: it.lastUsedAt ?? null,
+        lastIp: it.lastIp ?? null,
+        lastUserAgent: it.lastUserAgent ?? null,
+        createdIp: it.createdIp ?? null,
+        createdUserAgent: it.createdUserAgent ?? null,
+        isCurrent: it.isCurrent,
+        trustForwardedClientInfo: it.trustForwardedClientInfo
+      })),
+      identityProviders: person.identityProviders.map((it) => ({
+        id: it.id,
+        slug: it.identityProvider.slug,
+        type: it.identityProvider.type,
+        externalIdentifier: it.externalIdentifier,
+        createdAt: it.createdAt
+      }))
+    };
+  }
+  /**
+   * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's
+   * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.
+   */
+  async signUp({ email, password, passwordHash, name, roles, captchaToken }) {
+    const result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken });
+    this.transport.assertOk(result.signUp, `signUp(${email})`);
+    const person = result.signUp?.result?.person;
+    if (!person) {
+      throw new CliError(`signUp(${email}) reported success but returned no person`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+    }
+    return toTenantPerson(person);
+  }
+  async changeProfile(personId, { email, name }) {
+    const result = await this.transport.exec(changeProfileFetcher, { personId, email, name });
+    this.transport.assertOk(result.changeProfile, `changeProfile(${personId})`);
+  }
+  async changePassword(personId, password) {
+    const result = await this.transport.exec(changePasswordFetcher, { personId, password });
+    this.transport.assertOk(result.changePassword, `changePassword(${personId})`);
+  }
+  async disablePerson(personId) {
+    const result = await this.transport.exec(disablePersonFetcher, { personId });
+    this.transport.assertOk(result.disablePerson, `disablePerson(${personId})`);
+  }
+  async forceSignOutPerson(personId, reason) {
+    const result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason });
+    this.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`);
+  }
+  async resetPersonMfa(personId) {
+    const result = await this.transport.exec(resetPersonMfaFetcher, { personId });
+    this.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`);
+  }
+  async createResetPasswordRequest(email, options, captchaToken) {
+    const result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken });
+    this.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`);
+  }
+  async createSessionToken({ email, personId, expiration, options }) {
+    const result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options });
+    this.transport.assertOk(result.createSessionToken, "createSessionToken");
+    const tokenResult = result.createSessionToken?.result;
+    if (!tokenResult) {
+      throw new CliError("createSessionToken reported success but returned no token.", {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+    }
+    return {
+      token: tokenResult.token,
+      personId: tokenResult.person.id,
+      identityId: tokenResult.person.identity.id,
+      email: tokenResult.person.email ?? null,
+      name: tokenResult.person.name ?? null
+    };
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async addGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async removeGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+}
+export {
+  TenantPersonClient
+};
+//# sourceMappingURL=TenantPersonClient.js.map

package/dist/production/src/lib/tenant/clients/TenantPersonClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPersonClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddGlobalIdentityRolesError$$,\n\taddGlobalIdentityRolesResponse$$,\n\taddGlobalIdentityRolesResult$,\n\tchangePasswordError$$,\n\tchangePasswordResponse$$,\n\tchangeProfileError$$,\n\tchangeProfileResponse$$,\n\tcreatePasswordResetRequestError$$,\n\tcreatePasswordResetRequestResponse$$,\n\ttype CreateResetPasswordRequestOptions,\n\tcreateSessionTokenError$$,\n\tcreateSessionTokenResponse$$,\n\tcreateSessionTokenResult$,\n\tdisablePersonError$$,\n\tdisablePersonResponse$$,\n\tforceSignOutPersonError$$,\n\tforceSignOutPersonResponse$$,\n\tidentity$,\n\tidentityProviderListItem$$,\n\tmutation$,\n\tperson$$,\n\tpersonIdentityProvider$,\n\ttype PersonsFilter,\n\tquery$,\n\tremoveGlobalIdentityRolesError$$,\n\tremoveGlobalIdentityRolesResponse$$,\n\tremoveGlobalIdentityRolesResult$,\n\tresetPersonMfaError$$,\n\tresetPersonMfaResponse$$,\n\tsessionInfo$$,\n\ttype SignInOptions,\n\tsignUpError$$,\n\tsignUpResponse$$,\n\tsignUpResult$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantPerson {\n\tid: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\totpEnabled: boolean\n\temailOtpEnabled: boolean\n\temailVerified: boolean\n}\n\nexport interface TenantPersonSession {\n\tid: string\n\tcreatedAt: string\n\texpiresAt: string | null\n\tlastUsedAt: string | null\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tcreatedIp: string | null\n\tcreatedUserAgent: string | null\n\tisCurrent: boolean\n\ttrustForwardedClientInfo: boolean\n}\n\nexport interface TenantPersonIdentityProvider {\n\tid: string\n\tslug: string\n\ttype: string\n\texternalIdentifier: string\n\tcreatedAt: string\n}\n\n/**\n * Everything `personById` exposes about a single person. `roles` is null when the caller may not read\n * them, and `sessions` / `identityProviders` come back empty (never an error) for the same reason.\n */\nexport interface TenantPersonDetail extends TenantPerson {\n\tpasswordlessEnabled: boolean | null\n\troles: string[] | null\n\tsessions: TenantPersonSession[]\n\tidentityProviders: TenantPersonIdentityProvider[]\n}\n\nexport interface ListPersonsArgs {\n\tfilter?: PersonsFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface SignUpPersonArgs {\n\temail: string\n\t/** Plaintext password. Mutually exclusive with {@link passwordHash}; omit both to create a person without one. */\n\tpassword?: string\n\t/** Pre-computed bcrypt hash — the tenant API accepts `$2b$` only. */\n\tpasswordHash?: string\n\tname?: string\n\troles?: readonly string[]\n\tcaptchaToken?: string\n}\n\nexport interface CreateSessionTokenArgs {\n\temail?: string\n\tpersonId?: string\n\texpiration?: number\n\toptions?: SignInOptions\n}\n\nexport interface TenantCreatedSessionToken {\n\ttoken: string\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n}\n\nexport interface ChangeProfileArgs {\n\temail?: string\n\tname?: string\n}\n\n/** The subset of a `person$$` selection the CLI maps — an actual row carries more, which is fine. */\ninterface PersonRow {\n\treadonly id: string\n\treadonly email?: string\n\treadonly name?: string\n\treadonly otpEnabled: boolean\n\treadonly emailOtpEnabled: boolean\n\treadonly emailVerified: boolean\n\treadonly identity: { readonly id: string }\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst personsFetcher = query$.persons(person$$.identity(identity$.id))\nconst personByIdFetcher = query$.personById(\n\tperson$$\n\t\t.identity(identity$.id.roles.sessions(sessionInfo$$))\n\t\t.identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$)),\n)\nconst signUpFetcher = mutation$.signUp(\n\tsignUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id))),\n)\nconst changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$))\nconst changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons))\nconst disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$))\nconst forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$))\nconst resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$))\nconst createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(\n\tcreatePasswordResetRequestResponse$$.error(createPasswordResetRequestError$$),\n)\nconst createSessionTokenFetcher = mutation$.createSessionToken(\n\tcreateSessionTokenResponse$$\n\t\t.error(createSessionTokenError$$)\n\t\t.result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id))),\n)\nconst addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(\n\taddGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles)),\n)\nconst removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(\n\tremoveGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(\n\t\tremoveGlobalIdentityRolesResult$.identity(identity$.id.roles),\n\t),\n)\n\nconst toTenantPerson = (person: PersonRow): TenantPerson => ({\n\tid: person.id,\n\tidentityId: person.identity.id,\n\temail: person.email ?? null,\n\tname: person.name ?? null,\n\totpEnabled: person.otpEnabled,\n\temailOtpEnabled: person.emailOtpEnabled,\n\temailVerified: person.emailVerified,\n})\n\n/** Persons, their global identity roles and their sessions. */\nexport class TenantPersonClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listPersons({ filter, limit, offset }: ListPersonsArgs = {}): Promise<TenantPerson[]> {\n\t\tconst result = await this.transport.exec(personsFetcher, { filter, limit, offset })\n\t\treturn result.persons.map(it => ({\n\t\t\tid: it.id,\n\t\t\tidentityId: it.identity.id,\n\t\t\temail: it.email ?? null,\n\t\t\tname: it.name ?? null,\n\t\t\totpEnabled: it.otpEnabled,\n\t\t\temailOtpEnabled: it.emailOtpEnabled,\n\t\t\temailVerified: it.emailVerified,\n\t\t}))\n\t}\n\n\t/** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */\n\tpublic async getPerson(id: string): Promise<TenantPersonDetail | null> {\n\t\tconst result = await this.transport.exec(personByIdFetcher, { id })\n\t\tconst person = result.personById\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...toTenantPerson(person),\n\t\t\tpasswordlessEnabled: person.passwordlessEnabled ?? null,\n\t\t\troles: person.identity.roles ? [...person.identity.roles] : null,\n\t\t\tsessions: person.identity.sessions.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\texpiresAt: it.expiresAt ?? null,\n\t\t\t\tlastUsedAt: it.lastUsedAt ?? null,\n\t\t\t\tlastIp: it.lastIp ?? null,\n\t\t\t\tlastUserAgent: it.lastUserAgent ?? null,\n\t\t\t\tcreatedIp: it.createdIp ?? null,\n\t\t\t\tcreatedUserAgent: it.createdUserAgent ?? null,\n\t\t\t\tisCurrent: it.isCurrent,\n\t\t\t\ttrustForwardedClientInfo: it.trustForwardedClientInfo,\n\t\t\t})),\n\t\t\tidentityProviders: person.identityProviders.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tslug: it.identityProvider.slug,\n\t\t\t\ttype: it.identityProvider.type,\n\t\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t})),\n\t\t}\n\t}\n\n\t/**\n\t * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's\n\t * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.\n\t */\n\tpublic async signUp({ email, password, passwordHash, name, roles, captchaToken }: SignUpPersonArgs): Promise<TenantPerson> {\n\t\tconst result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken })\n\t\tthis.transport.assertOk(result.signUp, `signUp(${email})`)\n\t\tconst person = result.signUp?.result?.person\n\t\tif (!person) {\n\t\t\tthrow new CliError(`signUp(${email}) reported success but returned no person`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn toTenantPerson(person)\n\t}\n\n\tpublic async changeProfile(personId: string, { email, name }: ChangeProfileArgs): Promise<void> {\n\t\tconst result = await this.transport.exec(changeProfileFetcher, { personId, email, name })\n\t\tthis.transport.assertOk(result.changeProfile, `changeProfile(${personId})`)\n\t}\n\n\tpublic async changePassword(personId: string, password: string): Promise<void> {\n\t\tconst result = await this.transport.exec(changePasswordFetcher, { personId, password })\n\t\tthis.transport.assertOk(result.changePassword, `changePassword(${personId})`)\n\t}\n\n\tpublic async disablePerson(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disablePersonFetcher, { personId })\n\t\tthis.transport.assertOk(result.disablePerson, `disablePerson(${personId})`)\n\t}\n\n\tpublic async forceSignOutPerson(personId: string, reason?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason })\n\t\tthis.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`)\n\t}\n\n\tpublic async resetPersonMfa(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(resetPersonMfaFetcher, { personId })\n\t\tthis.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`)\n\t}\n\n\tpublic async createResetPasswordRequest(email: string, options?: CreateResetPasswordRequestOptions, captchaToken?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken })\n\t\tthis.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`)\n\t}\n\n\tpublic async createSessionToken({ email, personId, expiration, options }: CreateSessionTokenArgs): Promise<TenantCreatedSessionToken> {\n\t\tconst result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options })\n\t\tthis.transport.assertOk(result.createSessionToken, 'createSessionToken')\n\t\tconst tokenResult = result.createSessionToken?.result\n\t\tif (!tokenResult) {\n\t\t\tthrow new CliError('createSessionToken reported success but returned no token.', {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\ttoken: tokenResult.token,\n\t\t\tpersonId: tokenResult.person.id,\n\t\t\tidentityId: tokenResult.person.identity.id,\n\t\t\temail: tokenResult.person.email ?? null,\n\t\t\tname: tokenResult.person.name ?? null,\n\t\t}\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async addGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async removeGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n}\n"],"names":[],"mappings":";;AAkIA,MAAM,iBAAiB,OAAO,QAAQ,SAAS,SAAS,UAAU,EAAE,CAAC;AACrE,MAAM,oBAAoB,OAAO;AAAA,EAChC,SACE,SAAS,UAAU,GAAG,MAAM,SAAS,aAAa,CAAC,EACnD,kBAAkB,wBAAwB,GAAG,UAAU,mBAAmB,iBAAiB,0BAA0B,CAAC;AACzH;AACA,MAAM,gBAAgB,UAAU;AAAA,EAC/B,iBAAiB,MAAM,cAAc,oBAAoB,iBAAiB,EAAE,OAAO,cAAc,OAAO,SAAS,SAAS,UAAU,EAAE,CAAC,CAAC;AACzI;AACA,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AACxG,MAAM,wBAAwB,UAAU,eAAe,yBAAyB,MAAM,sBAAsB,mBAAmB,CAAC;AAChI,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AACxG,MAAM,4BAA4B,UAAU,mBAAmB,6BAA6B,MAAM,yBAAyB,CAAC;AAC5H,MAAM,wBAAwB,UAAU,eAAe,yBAAyB,MAAM,qBAAqB,CAAC;AAC5G,MAAM,oCAAoC,UAAU;AAAA,EACnD,qCAAqC,MAAM,iCAAiC;AAC7E;AACA,MAAM,4BAA4B,UAAU;AAAA,EAC3C,6BACE,MAAM,yBAAyB,EAC/B,OAAO,0BAA0B,MAAM,OAAO,SAAS,GAAG,MAAM,KAAK,SAAS,UAAU,EAAE,CAAC,CAAC;AAC/F;AACA,MAAM,gCAAgC,UAAU;AAAA,EAC/C,iCAAiC,MAAM,6BAA6B,EAAE,OAAO,8BAA8B,SAAS,UAAU,GAAG,KAAK,CAAC;AACxI;AACA,MAAM,mCAAmC,UAAU;AAAA,EAClD,oCAAoC,MAAM,gCAAgC,EAAE;AAAA,IAC3E,iCAAiC,SAAS,UAAU,GAAG,KAAK;AAAA,EAAA;AAE9D;AAEA,MAAM,iBAAiB,CAAC,YAAqC;AAAA,EAC5D,IAAI,OAAO;AAAA,EACX,YAAY,OAAO,SAAS;AAAA,EAC5B,OAAO,OAAO,SAAS;AAAA,EACvB,MAAM,OAAO,QAAQ;AAAA,EACrB,YAAY,OAAO;AAAA,EACnB,iBAAiB,OAAO;AAAA,EACxB,eAAe,OAAO;AACvB;AAGO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAA6B;AAClG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO,OAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MAChC,IAAI,GAAG;AAAA,MACP,YAAY,GAAG,SAAS;AAAA,MACxB,OAAO,GAAG,SAAS;AAAA,MACnB,MAAM,GAAG,QAAQ;AAAA,MACjB,YAAY,GAAG;AAAA,MACf,iBAAiB,GAAG;AAAA,MACpB,eAAe,GAAG;AAAA,IAAA,EACjB;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,UAAU,IAAgD;AACtE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,IAAI;AAClE,UAAM,SAAS,OAAO;AACtB,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,eAAe,MAAM;AAAA,MACxB,qBAAqB,OAAO,uBAAuB;AAAA,MACnD,OAAO,OAAO,SAAS,QAAQ,CAAC,GAAG,OAAO,SAAS,KAAK,IAAI;AAAA,MAC5D,UAAU,OAAO,SAAS,SAAS,IAAI,CAAA,QAAO;AAAA,QAC7C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,WAAW,GAAG,aAAa;AAAA,QAC3B,YAAY,GAAG,cAAc;AAAA,QAC7B,QAAQ,GAAG,UAAU;AAAA,QACrB,eAAe,GAAG,iBAAiB;AAAA,QACnC,WAAW,GAAG,aAAa;AAAA,QAC3B,kBAAkB,GAAG,oBAAoB;AAAA,QACzC,WAAW,GAAG;AAAA,QACd,0BAA0B,GAAG;AAAA,MAAA,EAC5B;AAAA,MACF,mBAAmB,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,QACtD,IAAI,GAAG;AAAA,QACP,MAAM,GAAG,iBAAiB;AAAA,QAC1B,MAAM,GAAG,iBAAiB;AAAA,QAC1B,oBAAoB,GAAG;AAAA,QACvB,WAAW,GAAG;AAAA,MAAA,EACb;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAO,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,gBAAyD;AAC1H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,cAAc;AACpH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,KAAK,GAAG;AACzD,UAAM,SAAS,OAAO,QAAQ,QAAQ;AACtC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,SAAS,UAAU,KAAK,6CAA6C;AAAA,QAC9E,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO,eAAe,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAa,cAAc,UAAkB,EAAE,OAAO,QAA0C;AAC/F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU,OAAO,MAAM;AACxF,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,eAAe,UAAkB,UAAiC;AAC9E,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU,UAAU;AACtF,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,cAAc,UAAiC;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU;AAC3E,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,mBAAmB,UAAkB,QAAgC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,UAAU,QAAQ;AACxF,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,QAAQ,GAAG;AAAA,EACrF;AAAA,EAEA,MAAa,eAAe,UAAiC;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU;AAC5E,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,2BAA2B,OAAe,SAA6C,cAAsC;AACzI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mCAAmC,EAAE,OAAO,SAAS,cAAc;AAC5G,SAAK,UAAU,SAAS,OAAO,4BAA4B,8BAA8B,KAAK,GAAG;AAAA,EAClG;AAAA,EAEA,MAAa,mBAAmB,EAAE,OAAO,UAAU,YAAY,WAAuE;AACrI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,OAAO,UAAU,YAAY,QAAA,CAAS;AAC5G,SAAK,UAAU,SAAS,OAAO,oBAAoB,oBAAoB;AACvE,UAAM,cAAc,OAAO,oBAAoB;AAC/C,QAAI,CAAC,aAAa;AACjB,YAAM,IAAI,SAAS,8DAA8D;AAAA,QAChF,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,MACN,OAAO,YAAY;AAAA,MACnB,UAAU,YAAY,OAAO;AAAA,MAC7B,YAAY,YAAY,OAAO,SAAS;AAAA,MACxC,OAAO,YAAY,OAAO,SAAS;AAAA,MACnC,MAAM,YAAY,OAAO,QAAQ;AAAA,IAAA;AAAA,EAEnC;AAAA;AAAA,EAGA,MAAa,uBAAuB,YAAoB,OAAoD;AAC3G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,+BAA+B,EAAE,YAAY,OAAO;AAC7F,SAAK,UAAU,SAAS,OAAO,wBAAwB,0BAA0B,UAAU,GAAG;AAC9F,UAAM,cAAc,OAAO,wBAAwB,QAAQ,SAAS;AACpE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AAAA;AAAA,EAGA,MAAa,0BAA0B,YAAoB,OAAoD;AAC9G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kCAAkC,EAAE,YAAY,OAAO;AAChG,SAAK,UAAU,SAAS,OAAO,2BAA2B,6BAA6B,UAAU,GAAG;AACpG,UAAM,cAAc,OAAO,2BAA2B,QAAQ,SAAS;AACvE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AACD;"}

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.cjs

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApi = require("@contember/graphql-client-tenant");
+const authPolicy = require("../authPolicy.cjs");
+const authPoliciesFetcher = TenantApi.query$.authPolicies(TenantApi.authPolicy$$);
+const createAuthPolicyFetcher = TenantApi.mutation$.createAuthPolicy(
+  TenantApi.createAuthPolicyResponse$$.error(TenantApi.createAuthPolicyError$$).result(TenantApi.createAuthPolicyResult$$)
+);
+const updateAuthPolicyFetcher = TenantApi.mutation$.updateAuthPolicy(TenantApi.updateAuthPolicyResponse$$.error(TenantApi.updateAuthPolicyError$$));
+const deleteAuthPolicyFetcher = TenantApi.mutation$.deleteAuthPolicy(TenantApi.deleteAuthPolicyResponse$$.error(TenantApi.deleteAuthPolicyError$$));
+const mailTemplatesFetcher = TenantApi.query$.mailTemplates(TenantApi.mailTemplateData$$);
+const addMailTemplateFetcher = TenantApi.mutation$.addMailTemplate(TenantApi.addMailTemplateResponse$$.error(TenantApi.addMailTemplateError$$));
+const removeMailTemplateFetcher = TenantApi.mutation$.removeMailTemplate(TenantApi.removeMailTemplateResponse$$.error(TenantApi.removeMailTemplateError$$));
+const authLogFetcher = TenantApi.query$.authLog(TenantApi.authLogPage$.hasMore.entries(TenantApi.authLogEntry$$));
+class TenantPolicyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listAuthPolicies() {
+    const result = await this.transport.exec(authPoliciesFetcher, {});
+    return result.authPolicies.map((it) => ({
+      id: it.id,
+      scope: it.scope,
+      project: it.project ?? null,
+      roles: [...it.roles],
+      mfaRequired: it.mfaRequired ?? null,
+      tokenExpiration: it.tokenExpiration ?? null,
+      idleTimeout: it.idleTimeout ?? null,
+      mfaGraceDuration: it.mfaGraceDuration ?? null,
+      rememberMeAllowed: it.rememberMeAllowed ?? null
+    }));
+  }
+  /** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */
+  async createAuthPolicy(policy) {
+    const result = await this.transport.exec(createAuthPolicyFetcher, { policy });
+    this.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${authPolicy.describeAuthPolicy(policy)})`);
+    const id = result.createAuthPolicy?.result?.id;
+    if (id === void 0) {
+      throw new cliCommon.CliError(`createAuthPolicy(${authPolicy.describeAuthPolicy(policy)}) reported success without returning an id.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+    }
+    return id;
+  }
+  async updateAuthPolicy(id, policy) {
+    const result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy });
+    this.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${authPolicy.describeAuthPolicy(policy)})`);
+  }
+  async deleteAuthPolicy(id) {
+    const result = await this.transport.exec(deleteAuthPolicyFetcher, { id });
+    this.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`);
+  }
+  async listMailTemplates() {
+    const result = await this.transport.exec(mailTemplatesFetcher, {});
+    return result.mailTemplates.map((it) => ({
+      projectSlug: it.projectSlug ?? null,
+      type: it.type,
+      variant: it.variant ?? null,
+      subject: it.subject,
+      content: it.content,
+      useLayout: it.useLayout,
+      replyTo: it.replyTo ?? null
+    }));
+  }
+  async addMailTemplate(template) {
+    const result = await this.transport.exec(addMailTemplateFetcher, { template });
+    this.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ""})`);
+  }
+  /** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */
+  async removeMailTemplate(templateIdentifier) {
+    const result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier });
+    this.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ""})`);
+  }
+  async readAuthLog({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(authLogFetcher, { filter, limit, offset });
+    return {
+      hasMore: result.authLog.hasMore,
+      entries: result.authLog.entries.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        type: it.type,
+        success: it.success,
+        invokedByIdentityId: it.invokedByIdentityId ?? null,
+        personId: it.personId ?? null,
+        targetPersonId: it.targetPersonId ?? null,
+        personInputIdentifier: it.personInputIdentifier ?? null,
+        errorCode: it.errorCode ?? null,
+        errorMessage: it.errorMessage ?? null,
+        ipAddress: it.ipAddress ?? null,
+        userAgent: it.userAgent ?? null,
+        identityProviderId: it.identityProviderId ?? null,
+        metadata: it.metadata ?? null,
+        eventData: it.eventData ?? null
+      }))
+    };
+  }
+}
+exports.TenantPolicyClient = TenantPolicyClient;
+//# sourceMappingURL=TenantPolicyClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPolicyClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddMailTemplateError$$,\n\taddMailTemplateResponse$$,\n\tauthLogEntry$$,\n\ttype AuthLogFilter,\n\tauthLogPage$,\n\tauthPolicy$$,\n\ttype AuthPolicyInput,\n\ttype AuthPolicyScope,\n\tcreateAuthPolicyError$$,\n\tcreateAuthPolicyResponse$$,\n\tcreateAuthPolicyResult$$,\n\tdeleteAuthPolicyError$$,\n\tdeleteAuthPolicyResponse$$,\n\tmailTemplateData$$,\n\ttype MailTemplateIdentifier,\n\ttype MailType,\n\tmutation$,\n\tquery$,\n\tremoveMailTemplateError$$,\n\tremoveMailTemplateResponse$$,\n\tupdateAuthPolicyError$$,\n\tupdateAuthPolicyResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { describeAuthPolicy } from '../authPolicy.js'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantMailTemplate } from '../tenantConfig.js'\n\n/** A policy as it exists server-side. The config-side counterpart is `TenantAuthPolicy` in `tenantConfig.ts`. */\nexport interface RemoteAuthPolicy {\n\tid: string\n\tscope: AuthPolicyScope\n\t/** Project slug, `null` for a global policy. */\n\tproject: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\t/** ISO 8601 duration, e.g. `PT1H`. */\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tmfaGraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\nexport interface TenantMailTemplateData {\n\tprojectSlug: string | null\n\ttype: MailType\n\tvariant: string | null\n\tsubject: string\n\tcontent: string\n\tuseLayout: boolean\n\treplyTo: string | null\n}\n\nexport interface TenantAuthLogEntry {\n\tid: string\n\tcreatedAt: string\n\ttype: string\n\tsuccess: boolean\n\tinvokedByIdentityId: string | null\n\tpersonId: string | null\n\ttargetPersonId: string | null\n\tpersonInputIdentifier: string | null\n\terrorCode: string | null\n\terrorMessage: string | null\n\tipAddress: string | null\n\tuserAgent: string | null\n\tidentityProviderId: string | null\n\tmetadata: unknown\n\teventData: unknown\n}\n\nexport interface TenantAuthLogPage {\n\tentries: TenantAuthLogEntry[]\n\t/** True when more rows exist past `offset + entries.length`. */\n\thasMore: boolean\n}\n\nexport interface ReadAuthLogArgs {\n\tfilter?: AuthLogFilter\n\tlimit?: number\n\toffset?: number\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst authPoliciesFetcher = query$.authPolicies(authPolicy$$)\nconst createAuthPolicyFetcher = mutation$.createAuthPolicy(\n\tcreateAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$),\n)\nconst updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$))\nconst deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$))\nconst mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$)\nconst addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))\nconst removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$))\nconst authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$))\n\n/** Auth policies, mail templates and the auth log. */\nexport class TenantPolicyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listAuthPolicies(): Promise<RemoteAuthPolicy[]> {\n\t\tconst result = await this.transport.exec(authPoliciesFetcher, {})\n\t\treturn result.authPolicies.map(it => ({\n\t\t\tid: it.id,\n\t\t\tscope: it.scope,\n\t\t\tproject: it.project ?? null,\n\t\t\troles: [...it.roles],\n\t\t\tmfaRequired: it.mfaRequired ?? null,\n\t\t\ttokenExpiration: it.tokenExpiration ?? null,\n\t\t\tidleTimeout: it.idleTimeout ?? null,\n\t\t\tmfaGraceDuration: it.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: it.rememberMeAllowed ?? null,\n\t\t}))\n\t}\n\n\t/** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */\n\tpublic async createAuthPolicy(policy: AuthPolicyInput): Promise<string> {\n\t\tconst result = await this.transport.exec(createAuthPolicyFetcher, { policy })\n\t\t// a policy has no slug, so the target is the only thing that identifies it in an error\n\t\tthis.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`)\n\t\tconst id = result.createAuthPolicy?.result?.id\n\t\tif (id === undefined) {\n\t\t\t// ok without a result breaks the schema contract, so there is nothing sensible to report back\n\t\t\tthrow new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn id\n\t}\n\n\tpublic async updateAuthPolicy(id: string, policy: AuthPolicyInput): Promise<void> {\n\t\tconst result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy })\n\t\tthis.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`)\n\t}\n\n\tpublic async deleteAuthPolicy(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(deleteAuthPolicyFetcher, { id })\n\t\tthis.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`)\n\t}\n\n\tpublic async listMailTemplates(): Promise<TenantMailTemplateData[]> {\n\t\tconst result = await this.transport.exec(mailTemplatesFetcher, {})\n\t\treturn result.mailTemplates.map(it => ({\n\t\t\tprojectSlug: it.projectSlug ?? null,\n\t\t\ttype: it.type,\n\t\t\tvariant: it.variant ?? null,\n\t\t\tsubject: it.subject,\n\t\t\tcontent: it.content,\n\t\t\tuseLayout: it.useLayout,\n\t\t\treplyTo: it.replyTo ?? null,\n\t\t}))\n\t}\n\n\tpublic async addMailTemplate(template: TenantMailTemplate): Promise<void> {\n\t\tconst result = await this.transport.exec(addMailTemplateFetcher, { template })\n\t\tthis.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)\n\t}\n\n\t/** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */\n\tpublic async removeMailTemplate(templateIdentifier: MailTemplateIdentifier): Promise<void> {\n\t\tconst result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier })\n\t\tthis.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ''})`)\n\t}\n\n\tpublic async readAuthLog({ filter, limit, offset }: ReadAuthLogArgs = {}): Promise<TenantAuthLogPage> {\n\t\tconst result = await this.transport.exec(authLogFetcher, { filter, limit, offset })\n\t\treturn {\n\t\t\thasMore: result.authLog.hasMore,\n\t\t\tentries: result.authLog.entries.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\ttype: it.type,\n\t\t\t\tsuccess: it.success,\n\t\t\t\tinvokedByIdentityId: it.invokedByIdentityId ?? null,\n\t\t\t\tpersonId: it.personId ?? null,\n\t\t\t\ttargetPersonId: it.targetPersonId ?? null,\n\t\t\t\tpersonInputIdentifier: it.personInputIdentifier ?? null,\n\t\t\t\terrorCode: it.errorCode ?? null,\n\t\t\t\terrorMessage: it.errorMessage ?? null,\n\t\t\t\tipAddress: it.ipAddress ?? null,\n\t\t\t\tuserAgent: it.userAgent ?? null,\n\t\t\t\tidentityProviderId: it.identityProviderId ?? null,\n\t\t\t\tmetadata: it.metadata ?? null,\n\t\t\t\teventData: it.eventData ?? null,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["query$","authPolicy$$","mutation$","createAuthPolicyResponse$$","createAuthPolicyError$$","createAuthPolicyResult$$","updateAuthPolicyResponse$$","updateAuthPolicyError$$","deleteAuthPolicyResponse$$","deleteAuthPolicyError$$","mailTemplateData$$","addMailTemplateResponse$$","addMailTemplateError$$","removeMailTemplateResponse$$","removeMailTemplateError$$","authLogPage$","authLogEntry$$","describeAuthPolicy","CliError","ExitCode"],"mappings":";;;;;AAqFA,MAAM,sBAAsBA,UAAAA,OAAO,aAAaC,sBAAY;AAC5D,MAAM,0BAA0BC,UAAAA,UAAU;AAAA,EACzCC,UAAAA,2BAA2B,MAAMC,iCAAuB,EAAE,OAAOC,UAAAA,wBAAwB;AAC1F;AACA,MAAM,0BAA0BH,UAAAA,UAAU,iBAAiBI,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,0BAA0BL,UAAAA,UAAU,iBAAiBM,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,uBAAuBT,UAAAA,OAAO,cAAcU,4BAAkB;AACpE,MAAM,yBAAyBR,UAAAA,UAAU,gBAAgBS,UAAAA,0BAA0B,MAAMC,UAAAA,sBAAsB,CAAC;AAChH,MAAM,4BAA4BV,UAAAA,UAAU,mBAAmBW,UAAAA,6BAA6B,MAAMC,UAAAA,yBAAyB,CAAC;AAC5H,MAAM,iBAAiBd,UAAAA,OAAO,QAAQe,UAAAA,aAAa,QAAQ,QAAQC,UAAAA,cAAc,CAAC;AAG3E,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,mBAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB,EAAE;AAChE,WAAO,OAAO,aAAa,IAAI,CAAA,QAAO;AAAA,MACrC,IAAI,GAAG;AAAA,MACP,OAAO,GAAG;AAAA,MACV,SAAS,GAAG,WAAW;AAAA,MACvB,OAAO,CAAC,GAAG,GAAG,KAAK;AAAA,MACnB,aAAa,GAAG,eAAe;AAAA,MAC/B,iBAAiB,GAAG,mBAAmB;AAAA,MACvC,aAAa,GAAG,eAAe;AAAA,MAC/B,kBAAkB,GAAG,oBAAoB;AAAA,MACzC,mBAAmB,GAAG,qBAAqB;AAAA,IAAA,EAC1C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,iBAAiB,QAA0C;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,QAAQ;AAE5E,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoBC,8BAAmB,MAAM,CAAC,GAAG;AAClG,UAAM,KAAK,OAAO,kBAAkB,QAAQ;AAC5C,QAAI,OAAO,QAAW;AAErB,YAAM,IAAIC,UAAAA,SAAS,oBAAoBD,WAAAA,mBAAmB,MAAM,CAAC,+CAA+C;AAAA,QAC/G,MAAM;AAAA,QACN,UAAUE,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,iBAAiB,IAAY,QAAwC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI,QAAQ;AAChF,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,KAAKF,WAAAA,mBAAmB,MAAM,CAAC,GAAG;AAAA,EAC1G;AAAA,EAEA,MAAa,iBAAiB,IAA2B;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI;AACxE,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,oBAAuD;AACnE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,aAAa,GAAG,eAAe;AAAA,MAC/B,MAAM,GAAG;AAAA,MACT,SAAS,GAAG,WAAW;AAAA,MACvB,SAAS,GAAG;AAAA,MACZ,SAAS,GAAG;AAAA,MACZ,WAAW,GAAG;AAAA,MACd,SAAS,GAAG,WAAW;AAAA,IAAA,EACtB;AAAA,EACH;AAAA,EAEA,MAAa,gBAAgB,UAA6C;AACzE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,UAAU;AAC7E,SAAK,UAAU,SAAS,OAAO,iBAAiB,mBAAmB,SAAS,IAAI,IAAI,SAAS,WAAW,EAAE,GAAG;AAAA,EAC9G;AAAA;AAAA,EAGA,MAAa,mBAAmB,oBAA2D;AAC1F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,oBAAoB;AAC1F,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,mBAAmB,IAAI,IAAI,mBAAmB,WAAW,EAAE,GAAG;AAAA,EACxI;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAAgC;AACrG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO;AAAA,MACN,SAAS,OAAO,QAAQ;AAAA,MACxB,SAAS,OAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,QAC1C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,MAAM,GAAG;AAAA,QACT,SAAS,GAAG;AAAA,QACZ,qBAAqB,GAAG,uBAAuB;AAAA,QAC/C,UAAU,GAAG,YAAY;AAAA,QACzB,gBAAgB,GAAG,kBAAkB;AAAA,QACrC,uBAAuB,GAAG,yBAAyB;AAAA,QACnD,WAAW,GAAG,aAAa;AAAA,QAC3B,cAAc,GAAG,gBAAgB;AAAA,QACjC,WAAW,GAAG,aAAa;AAAA,QAC3B,WAAW,GAAG,aAAa;AAAA,QAC3B,oBAAoB,GAAG,sBAAsB;AAAA,QAC7C,UAAU,GAAG,YAAY;AAAA,QACzB,WAAW,GAAG,aAAa;AAAA,MAAA,EAC1B;AAAA,IAAA;AAAA,EAEJ;AACD;;"}

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.js

@@ -0,0 +1,101 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { query$, authPolicy$$, mutation$, createAuthPolicyResponse$$, createAuthPolicyError$$, createAuthPolicyResult$$, updateAuthPolicyResponse$$, updateAuthPolicyError$$, deleteAuthPolicyResponse$$, deleteAuthPolicyError$$, mailTemplateData$$, addMailTemplateResponse$$, addMailTemplateError$$, removeMailTemplateResponse$$, removeMailTemplateError$$, authLogPage$, authLogEntry$$ } from "@contember/graphql-client-tenant";
+import { describeAuthPolicy } from "../authPolicy.js";
+const authPoliciesFetcher = query$.authPolicies(authPolicy$$);
+const createAuthPolicyFetcher = mutation$.createAuthPolicy(
+  createAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$)
+);
+const updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$));
+const deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$));
+const mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$);
+const addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$));
+const removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$));
+const authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$));
+class TenantPolicyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listAuthPolicies() {
+    const result = await this.transport.exec(authPoliciesFetcher, {});
+    return result.authPolicies.map((it) => ({
+      id: it.id,
+      scope: it.scope,
+      project: it.project ?? null,
+      roles: [...it.roles],
+      mfaRequired: it.mfaRequired ?? null,
+      tokenExpiration: it.tokenExpiration ?? null,
+      idleTimeout: it.idleTimeout ?? null,
+      mfaGraceDuration: it.mfaGraceDuration ?? null,
+      rememberMeAllowed: it.rememberMeAllowed ?? null
+    }));
+  }
+  /** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */
+  async createAuthPolicy(policy) {
+    const result = await this.transport.exec(createAuthPolicyFetcher, { policy });
+    this.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`);
+    const id = result.createAuthPolicy?.result?.id;
+    if (id === void 0) {
+      throw new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+    }
+    return id;
+  }
+  async updateAuthPolicy(id, policy) {
+    const result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy });
+    this.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`);
+  }
+  async deleteAuthPolicy(id) {
+    const result = await this.transport.exec(deleteAuthPolicyFetcher, { id });
+    this.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`);
+  }
+  async listMailTemplates() {
+    const result = await this.transport.exec(mailTemplatesFetcher, {});
+    return result.mailTemplates.map((it) => ({
+      projectSlug: it.projectSlug ?? null,
+      type: it.type,
+      variant: it.variant ?? null,
+      subject: it.subject,
+      content: it.content,
+      useLayout: it.useLayout,
+      replyTo: it.replyTo ?? null
+    }));
+  }
+  async addMailTemplate(template) {
+    const result = await this.transport.exec(addMailTemplateFetcher, { template });
+    this.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ""})`);
+  }
+  /** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */
+  async removeMailTemplate(templateIdentifier) {
+    const result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier });
+    this.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ""})`);
+  }
+  async readAuthLog({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(authLogFetcher, { filter, limit, offset });
+    return {
+      hasMore: result.authLog.hasMore,
+      entries: result.authLog.entries.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        type: it.type,
+        success: it.success,
+        invokedByIdentityId: it.invokedByIdentityId ?? null,
+        personId: it.personId ?? null,
+        targetPersonId: it.targetPersonId ?? null,
+        personInputIdentifier: it.personInputIdentifier ?? null,
+        errorCode: it.errorCode ?? null,
+        errorMessage: it.errorMessage ?? null,
+        ipAddress: it.ipAddress ?? null,
+        userAgent: it.userAgent ?? null,
+        identityProviderId: it.identityProviderId ?? null,
+        metadata: it.metadata ?? null,
+        eventData: it.eventData ?? null
+      }))
+    };
+  }
+}
+export {
+  TenantPolicyClient
+};
+//# sourceMappingURL=TenantPolicyClient.js.map