@contember/engine-tenant-api 1.2.1 → 1.3.0-alpha.2

package/src/schema/tenant.graphql.ts

@@ -28,12 +28,23 @@ const schema: DocumentNode = gql`
 		changePassword(personId: String!, password: String!): ChangePasswordResponse
 		changeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse
 
-		initSignInIDP(identityProvider: String!, redirectUrl: String!): InitSignInIDPResponse
-		signInIDP(identityProvider: String!, idpResponse: IDPResponseInput!, redirectUrl: String!, sessionData: Json!, expiration: Int): SignInIDPResponse
+		initSignInIDP(
+			identityProvider: String!,
+			data: Json
+			redirectUrl: String @deprecated(reason: "use data.redirectUrl")
+		): InitSignInIDPResponse
+		signInIDP(
+			identityProvider: String!, 
+			data: Json,
+			expiration: Int
+            idpResponse: IDPResponseInput, @deprecated(reason: "pass idpResponse.url as data.url")
+			redirectUrl: String @deprecated(reason: "use data.redirectUrl"), 
+			sessionData: Json @deprecated(reason: "use data.sessionData"), 
+		): SignInIDPResponse
 
 		# IDP management
 		addIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse
-		updateIDP(identityProvider: String!, configuration: Json, options: IDPOptions): UpdateIDPResponse
+		updateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions): UpdateIDPResponse
 		disableIDP(identityProvider: String!): DisableIDPResponse
 		enableIDP(identityProvider: String!): EnableIDPResponse
 
@@ -78,10 +89,10 @@ const schema: DocumentNode = gql`
 		updateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse
 
 		addProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse
-			@deprecated(reason: "use addMailtemplate")
+			@deprecated(reason: "use addMailTemplate")
 
 		removeProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse
-			@deprecated(reason: "use removeMailtemplate")
+			@deprecated(reason: "use removeMailTemplate")
 
 	}
 
@@ -242,6 +253,7 @@ const schema: DocumentNode = gql`
 
 	enum InitSignInIDPErrorCode {
 		PROVIDER_NOT_FOUND
+        IDP_VALIDATION_FAILED
 	}
 
 	input IDPResponseInput {
@@ -607,7 +619,21 @@ const schema: DocumentNode = gql`
 		slug: String!
 		config: Json!
 		roles: [RoleDefinition!]!
-		members(memberType: MemberType): [ProjectIdentityRelation!]!
+		members(
+			input: ProjectMembersInput,
+			memberType: MemberType @deprecated(reason: "Use args")
+		): [ProjectIdentityRelation!]!
+	}
+
+	input ProjectMembersInput {
+		limit: Int
+		offset: Int
+		filter: ProjectMembersFilter
+	}
+
+	input ProjectMembersFilter {
+		memberType: MemberType
+		email: String
 	}
 
 	enum MemberType {

package/src/tsconfig.json

@@ -5,35 +5,15 @@
 		"esModuleInterop": true
 	},
 	"references": [
-		{
-			"path": "../../authorization/src"
-		},
-		{
-			"path": "../../config-loader/src"
-		},
-		{
-			"path": "../../database/src"
-		},
-		{
-			"path": "../../database-migrations/src"
-		},
-		{
-			"path": "../../dic/src"
-		},
-		{
-			"path": "../../logger/src"
-		},
-		{
-			"path": "../../graphql-utils/src"
-		},
-		{
-			"path": "../../schema/src"
-		},
-		{
-			"path": "../../schema-utils/src"
-		},
-		{
-			"path": "../../typesafe/src"
-		}
+		{ "path": "../../authorization/src" },
+		{ "path": "../../config-loader/src" },
+		{ "path": "../../database/src" },
+		{ "path": "../../database-migrations/src" },
+		{ "path": "../../dic/src" },
+		{ "path": "../../logger/src" },
+		{ "path": "../../graphql-utils/src" },
+		{ "path": "../../schema/src" },
+		{ "path": "../../schema-utils/src" },
+		{ "path": "../../typesafe/src" }
 	]
 }

package/tests/cases/integration/db/invite.test.ts

@@ -40,13 +40,13 @@ test('admin can invite a user with a membership', testTenantDb(async ({ tester }
 				}
 			}
 		`)
-	assert.equal(identity, testUuid(2))
+	assert.equal(identity, testUuid(5))
 	assert.deepStrictEqual(resultListMembers.data, {
 		projectBySlug: {
 			members: [
 				{
 					identity: {
-						id: testUuid(2),
+						id: testUuid(5),
 					},
 					memberships: [
 						{

package/tests/cases/integration/db/unmanagedInvite.test.ts

@@ -27,9 +27,9 @@ test('does not send an email and sets given password', testTenantDb(async ({ tes
 		errors: [],
 		result: {
 			person: {
-				id: testUuid(3),
+				id: testUuid(6),
 				identity: {
-					id: testUuid(2),
+					id: testUuid(5),
 				},
 			},
 		},

package/{src → tests/cases}/migrations/2020-06-08-134000-tenant-credentials.test.ts

@@ -1,7 +1,9 @@
-import migration from './2020-06-08-134000-tenant-credentials'
+import migration from '../../../src/migrations/2020-06-08-134000-tenant-credentials'
 import { createMigrationBuilder } from '@contember/database-migrations'
 import { test, assert } from 'vitest'
 
+let uuidNum = 0
+export const testUuid = () => '123e4567-e89b-12d3-a456-' + (uuidNum++).toString().padStart(12, '0')
 test('generate sql with root token and login token', async () => {
 	const builder = createMigrationBuilder()
 	await migration(builder, {
@@ -9,23 +11,26 @@ test('generate sql with root token and login token', async () => {
 			loginTokenHash: '936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af',
 			rootTokenHash: 'c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2',
 		}),
+		providers: {
+			uuid: testUuid,
+		},
 	})
 	assert.equal(
 		builder.getSql(),
 		`
 			WITH identity AS (
 			    INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (public."uuid_generate_v4"(), NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
+				VALUES ($pga$123e4567-e89b-12d3-a456-000000000000$pga$, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
 			)
 			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-			SELECT public."uuid_generate_v4"(), $pga$936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af$pga$, 'permanent', identity.id, NULL, NULL, NULL, now()
+			SELECT $pga$123e4567-e89b-12d3-a456-000000000001$pga$, $pga$936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af$pga$, 'permanent', identity.id, NULL, NULL, NULL, now()
 			FROM identity
 			;
 
 			WITH identity AS (
 				INSERT INTO identity(id, parent_id, roles, description, created_at)
 				VALUES (
-						public."uuid_generate_v4"(),
+						$pga$123e4567-e89b-12d3-a456-000000000002$pga$,
 						NULL,
 						'["super_admin"]'::JSONB
 							|| (CASE WHEN NULL IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
@@ -35,14 +40,14 @@ test('generate sql with root token and login token', async () => {
 			),
 			person AS (
 				INSERT INTO person(id, email, password_hash, identity_id)
-				SELECT public."uuid_generate_v4"(), NULL, NULL, identity.id
+				SELECT $pga$123e4567-e89b-12d3-a456-000000000003$pga$, NULL, NULL, identity.id
 				FROM identity
 				WHERE NULL IS NOT NULL
 			    RETURNING id
 			),
 			api_key AS (
 				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-				SELECT public."uuid_generate_v4"(), $pga$c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2$pga$, 'permanent', identity.id, NULL, NULL, NULL, now()
+				SELECT $pga$123e4567-e89b-12d3-a456-000000000004$pga$, $pga$c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2$pga$, 'permanent', identity.id, NULL, NULL, NULL, now()
 				FROM identity WHERE $pga$c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2$pga$ IS NOT NULL
 			    RETURNING id
 			)
@@ -60,6 +65,9 @@ test('generate sql with both root user and token', async () => {
 			rootTokenHash: 'd96f62ea0f2f543aa7822a58114f75dbcc05bdf970fb15eb55eea836a1439e43',
 			rootEmail: 'john@doe.com',
 		}),
+		providers: {
+			uuid: testUuid,
+		},
 	})
 	assert.equal(
 		builder.getSql(),
@@ -67,7 +75,7 @@ test('generate sql with both root user and token', async () => {
 			WITH identity AS (
 				INSERT INTO identity(id, parent_id, roles, description, created_at)
 				VALUES (
-						public."uuid_generate_v4"(),
+						$pga$123e4567-e89b-12d3-a456-000000000005$pga$,
 						NULL,
 						'["super_admin"]'::JSONB
 							|| (CASE WHEN $pga$john@doe.com$pga$ IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
@@ -77,14 +85,14 @@ test('generate sql with both root user and token', async () => {
 			),
 			person AS (
 				INSERT INTO person(id, email, password_hash, identity_id)
-				SELECT public."uuid_generate_v4"(), $pga$john@doe.com$pga$, $pga$pwd-bcrypted$pga$, identity.id
+				SELECT $pga$123e4567-e89b-12d3-a456-000000000006$pga$, $pga$john@doe.com$pga$, $pga$pwd-bcrypted$pga$, identity.id
 				FROM identity
 				WHERE $pga$john@doe.com$pga$ IS NOT NULL
 			    RETURNING id
 			),
 			api_key AS (
 				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-				SELECT public."uuid_generate_v4"(), $pga$d96f62ea0f2f543aa7822a58114f75dbcc05bdf970fb15eb55eea836a1439e43$pga$, 'permanent', identity.id, NULL, NULL, NULL, now()
+				SELECT $pga$123e4567-e89b-12d3-a456-000000000007$pga$, $pga$d96f62ea0f2f543aa7822a58114f75dbcc05bdf970fb15eb55eea836a1439e43$pga$, 'permanent', identity.id, NULL, NULL, NULL, now()
 				FROM identity WHERE $pga$d96f62ea0f2f543aa7822a58114f75dbcc05bdf970fb15eb55eea836a1439e43$pga$ IS NOT NULL
 			    RETURNING id
 			)

package/tests/src/IdPMock.ts

@@ -1,14 +1,14 @@
-import { IdentityProviderHandler, IDPClaim, IDPResponse, InitIDPAuthResult } from '../../src'
+import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../../src'
 
-export class IdPMock implements IdentityProviderHandler<any, any> {
-	initAuth(configuration: any, redirectUrl: string): Promise<InitIDPAuthResult<any>> {
+export class IdPMock implements IdentityProviderHandler<any> {
+	initAuth(configuration: any, data: unknown): Promise<InitIDPAuthResult> {
 		return Promise.resolve({
 			authUrl: 'http://localhost',
 			sessionData: { foo: 'bar' },
 		})
 	}
 
-	processResponse(configuration: any, redirectUrl: string, idpResponse: IDPResponse, sessionData: any): Promise<IDPClaim> {
+	processResponse(configuration: any, responseData: any): Promise<IDPClaim> {
 		return Promise.resolve({
 			externalIdentifier: configuration.externalIdentifier,
 			email: configuration.email,

package/tests/tsconfig.json

@@ -5,11 +5,7 @@
 		"esModuleInterop": true
 	},
 	"references": [
-		{
-			"path": "../src"
-		},
-		{
-			"path": "../../engine-api-tester/src"
-		}
+		{ "path": "../src" },
+		{ "path": "../../engine-api-tester/src" }
 	]
 }

package/tsconfig.json

@@ -2,11 +2,7 @@
 	"files": [],
 	"include": [],
 	"references": [
-		{
-			"path": "./src"
-		},
-		{
-			"path": "./tests"
-		}
+		{ "path": "./src" },
+		{ "path": "./tests" }
 	]
 }

package/dist/src/migrations/2020-06-08-134000-tenant-credentials.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"2020-06-08-134000-tenant-credentials.test.d.ts","sourceRoot":"","sources":["../../../src/migrations/2020-06-08-134000-tenant-credentials.test.ts"],"names":[],"mappings":""}

package/dist/src/migrations/2020-06-08-134000-tenant-credentials.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"2020-06-08-134000-tenant-credentials.test.js","sourceRoot":"","sources":["../../../src/migrations/2020-06-08-134000-tenant-credentials.test.ts"],"names":[],"mappings":";;;;;AAAA,mHAA8D;AAC9D,wEAAuE;AACvE,mCAAqC;AAErC,IAAA,aAAI,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAA,4CAAsB,GAAE,CAAA;IACxC,MAAM,IAAA,+CAAS,EAAC,OAAO,EAAE;QACxB,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5B,cAAc,EAAE,kEAAkE;YAClF,aAAa,EAAE,kEAAkE;SACjF,CAAC;KACF,CAAC,CAAA;IACF,eAAM,CAAC,KAAK,CACX,OAAO,CAAC,MAAM,EAAE,EAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCD,CACC,CAAA;AACF,CAAC,CAAC,CAAA;AAEF,IAAA,aAAI,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,OAAO,GAAG,IAAA,4CAAsB,GAAE,CAAA;IACxC,MAAM,IAAA,+CAAS,EAAC,OAAO,EAAE;QACxB,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5B,oBAAoB,EAAE,cAAc;YACpC,aAAa,EAAE,kEAAkE;YACjF,SAAS,EAAE,cAAc;SACzB,CAAC;KACF,CAAC,CAAA;IACF,eAAM,CAAC,KAAK,CACX,OAAO,CAAC,MAAM,EAAE,EAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BD,CACC,CAAA;AACF,CAAC,CAAC,CAAA"}

package/dist/src/model/service/idp/OIDCProvider.d.ts

@@ -1,25 +0,0 @@
-import * as Typesafe from '@contember/typesafe';
-import { ResponseType } from 'openid-client';
-import { IdentityProviderHandler, IDPClaim, IDPResponse, InitIDPAuthResult } from './IdentityProviderHandler';
-export declare type OIDCConfiguration = ReturnType<typeof OIDCConfigurationSchema>;
-export interface SessionData {
-    nonce: string;
-    state: string;
-}
-declare const OIDCConfigurationSchema: Typesafe.Type<{
-    readonly url: string;
-    readonly clientId: string;
-    readonly clientSecret: string;
-} & {
-    readonly responseType?: ResponseType | undefined;
-    readonly claims?: string | undefined;
-}>;
-export declare class OIDCProvider implements IdentityProviderHandler<SessionData, OIDCConfiguration> {
-    private issuerCache;
-    initAuth(configuration: OIDCConfiguration, redirectUrl: string): Promise<InitIDPAuthResult<SessionData>>;
-    processResponse(configuration: OIDCConfiguration, redirectUrl: string, idpResponse: IDPResponse, sessionData: SessionData): Promise<IDPClaim>;
-    validateConfiguration(config: unknown): OIDCConfiguration;
-    private createOIDCClient;
-}
-export {};
-//# sourceMappingURL=OIDCProvider.d.ts.map

package/dist/src/model/service/idp/OIDCProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/OIDCProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAA8C,YAAY,EAAE,MAAM,eAAe,CAAA;AAExF,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAQ7G,oBAAY,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE1E,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACb;AAED,QAAA,MAAM,uBAAuB;;;;;;;EAU5B,CAAA;AAED,qBAAa,YAAa,YAAW,uBAAuB,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAC3F,OAAO,CAAC,WAAW,CAAqC;IAE3C,QAAQ,CACpB,aAAa,EAAE,iBAAiB,EAChC,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAgB7B,eAAe,CAC3B,aAAa,EAAE,iBAAiB,EAChC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACtB,OAAO,CAAC,QAAQ,CAAC;IAsBb,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,iBAAiB;YAWlD,gBAAgB;CAS9B"}

package/dist/src/model/service/idp/OIDCProvider.js

@@ -1,108 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OIDCProvider = void 0;
-const Typesafe = __importStar(require("@contember/typesafe"));
-const openid_client_1 = require("openid-client");
-const IDPResponseError_1 = require("./IDPResponseError");
-const IDPValidationError_1 = require("./IDPValidationError");
-const InvalidIDPConfigurationError_1 = require("./InvalidIDPConfigurationError");
-openid_client_1.custom.setHttpOptionsDefaults({
-    timeout: 5000,
-});
-const OIDCConfigurationSchema = Typesafe.intersection(Typesafe.object({
-    url: Typesafe.string,
-    clientId: Typesafe.string,
-    clientSecret: Typesafe.string,
-}), Typesafe.partial({
-    responseType: Typesafe.enumeration('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
-    claims: Typesafe.string,
-}));
-class OIDCProvider {
-    constructor() {
-        this.issuerCache = {};
-    }
-    async initAuth(configuration, redirectUrl) {
-        var _a;
-        const client = await this.createOIDCClient(configuration);
-        const nonce = openid_client_1.generators.nonce();
-        const state = openid_client_1.generators.state();
-        const url = client.authorizationUrl({
-            redirect_uri: redirectUrl,
-            scope: (_a = configuration.claims) !== null && _a !== void 0 ? _a : 'openid email',
-            nonce,
-            state,
-        });
-        return {
-            authUrl: url,
-            sessionData: { nonce, state },
-        };
-    }
-    async processResponse(configuration, redirectUrl, idpResponse, sessionData) {
-        const client = await this.createOIDCClient(configuration);
-        const params = client.callbackParams(idpResponse.url);
-        try {
-            const result = await client.callback(redirectUrl, params, sessionData);
-            const claims = result.claims();
-            return {
-                externalIdentifier: claims.sub,
-                email: claims.email,
-                name: claims.name,
-            };
-        }
-        catch (e) {
-            if (e instanceof openid_client_1.errors.RPError) {
-                throw new IDPValidationError_1.IDPValidationError(e.message);
-            }
-            if (e instanceof openid_client_1.errors.OPError) {
-                throw new IDPResponseError_1.IDPResponseError(e.message);
-            }
-            throw e;
-        }
-    }
-    validateConfiguration(config) {
-        try {
-            return OIDCConfigurationSchema(config);
-        }
-        catch (e) {
-            if (e instanceof Typesafe.ParseError) {
-                throw new InvalidIDPConfigurationError_1.InvalidIDPConfigurationError(e.message);
-            }
-            throw e;
-        }
-    }
-    async createOIDCClient(configuration) {
-        var _a;
-        var _b, _c;
-        (_a = (_b = this.issuerCache)[_c = configuration.url]) !== null && _a !== void 0 ? _a : (_b[_c] = await openid_client_1.Issuer.discover(configuration.url));
-        return new this.issuerCache[configuration.url].Client({
-            client_id: configuration.clientId,
-            client_secret: configuration.clientSecret,
-            response_types: [configuration.responseType || 'code'],
-        });
-    }
-}
-exports.OIDCProvider = OIDCProvider;
-//# sourceMappingURL=OIDCProvider.js.map

package/dist/src/model/service/idp/OIDCProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"OIDCProvider.js","sourceRoot":"","sources":["../../../../../src/model/service/idp/OIDCProvider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAA+C;AAC/C,iDAAwF;AACxF,yDAAqD;AAErD,6DAAyD;AACzD,iFAA6E;AAE7E,sBAAM,CAAC,sBAAsB,CAAC;IAC7B,OAAO,EAAE,IAAI;CACb,CAAC,CAAA;AASF,MAAM,uBAAuB,GAAG,QAAQ,CAAC,YAAY,CACpD,QAAQ,CAAC,MAAM,CAAC;IACf,GAAG,EAAE,QAAQ,CAAC,MAAM;IACpB,QAAQ,EAAE,QAAQ,CAAC,MAAM;IACzB,YAAY,EAAE,QAAQ,CAAC,MAAM;CAC7B,CAAC,EACF,QAAQ,CAAC,OAAO,CAAC;IAChB,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAe,MAAM,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC;IACpJ,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,CAAC,CACF,CAAA;AAED,MAAa,YAAY;IAAzB;QACS,gBAAW,GAAmC,EAAE,CAAA;IAoEzD,CAAC;IAlEO,KAAK,CAAC,QAAQ,CACpB,aAAgC,EAChC,WAAmB;;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;QACzD,MAAM,KAAK,GAAG,0BAAU,CAAC,KAAK,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,0BAAU,CAAC,KAAK,EAAE,CAAA;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;YACnC,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,MAAA,aAAa,CAAC,MAAM,mCAAI,cAAc;YAC7C,KAAK;YACL,KAAK;SACL,CAAC,CAAA;QACF,OAAO;YACN,OAAO,EAAE,GAAG;YACZ,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SAC7B,CAAA;IACF,CAAC;IAEM,KAAK,CAAC,eAAe,CAC3B,aAAgC,EAChC,WAAmB,EACnB,WAAwB,EACxB,WAAwB;QAExB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;YAC9B,OAAO;gBACN,kBAAkB,EAAE,MAAM,CAAC,GAAG;gBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;aACjB,CAAA;SACD;QAAC,OAAO,CAAC,EAAE;YACX,IAAI,CAAC,YAAY,sBAAM,CAAC,OAAO,EAAE;gBAChC,MAAM,IAAI,uCAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;aACvC;YACD,IAAI,CAAC,YAAY,sBAAM,CAAC,OAAO,EAAE;gBAChC,MAAM,IAAI,mCAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;aACrC;YACD,MAAM,CAAC,CAAA;SACP;IACF,CAAC;IAEM,qBAAqB,CAAC,MAAe;QAC3C,IAAI;YACH,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAA;SACtC;QAAC,OAAO,CAAC,EAAE;YACX,IAAI,CAAC,YAAY,QAAQ,CAAC,UAAU,EAAE;gBACrC,MAAM,IAAI,2DAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;aACjD;YACD,MAAM,CAAC,CAAA;SACP;IACF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,aAAgC;;;QAC9D,YAAA,IAAI,CAAC,WAAW,OAAC,aAAa,CAAC,GAAG,8CAAM,MAAM,sBAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,EAAA;QAEhF,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACrD,SAAS,EAAE,aAAa,CAAC,QAAQ;YACjC,aAAa,EAAE,aAAa,CAAC,YAAY;YACzC,cAAc,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,MAAM,CAAC;SACtD,CAAC,CAAA;IACH,CAAC;CACD;AArED,oCAqEC"}

package/src/migrations/2019-02-18-160155-session-expiration.sql

@@ -1,2 +0,0 @@
-ALTER TABLE "api_key"
-	ADD COLUMN expiration INT DEFAULT NULL;

package/src/migrations/2019-08-14-153300-project-slug-unique.sql

@@ -1,2 +0,0 @@
-CREATE UNIQUE INDEX "project_slug"
-    ON "project"("slug");

package/src/migrations/2019-09-06-111001-drop-old-member.sql

@@ -1,2 +0,0 @@
-DROP TABLE project_member;
-DROP TABLE project_member_variable;

package/src/migrations/2020-01-29-idenity-note.sql

@@ -1,9 +0,0 @@
-ALTER TABLE identity
-    ADD COLUMN description TEXT,
-    ADD COLUMN created_at  TIMESTAMP;
-
-UPDATE identity
-SET created_at = NOW();
-
-ALTER TABLE identity
-    ALTER created_at SET NOT NULL;

package/src/migrations/2020-04-17-fix-person-index.sql

@@ -1,3 +0,0 @@
-DROP INDEX "person_identity_id";
-
-CREATE INDEX "person_identity_id" ON "person" USING btree ("identity_id");

package/src/migrations/2020-05-01-170000-api-key-index.sql

@@ -1 +0,0 @@
-CREATE UNIQUE INDEX api_key_token_hash ON api_key(token_hash)

package/src/migrations/2020-08-07-110000-person-otp.sql

@@ -1,3 +0,0 @@
-ALTER TABLE "person"
-	ADD COLUMN otp_uri          TEXT      DEFAULT NULL,
-	ADD COLUMN otp_activated_at TIMESTAMP DEFAULT NULL

package/src/migrations/2021-07-26-105000-project-config.sql

@@ -1,3 +0,0 @@
-ALTER TABLE project
-	ADD COLUMN config JSONB NOT NULL DEFAULT '{}'::JSONB,
-    add column updated_at timestamptz not null DEFAULT now();

package/src/migrations/2021-07-27-174000-project-alias-index.sql

@@ -1 +0,0 @@
-CREATE INDEX project_alias ON project USING gin ((config -> 'alias'));

package/src/migrations/2021-11-24-130000-person-password-null.sql

@@ -1 +0,0 @@
-ALTER TABLE person ALTER COLUMN password_hash DROP NOT NULL;

package/src/migrations/2022-01-04-144000-person-unique-identity.sql

@@ -1,2 +0,0 @@
-ALTER TABLE person
-	ADD UNIQUE (identity_id);

package/src/migrations/2022-02-11-153000-idp-auto-sign-up.sql

@@ -1,2 +0,0 @@
-ALTER TABLE identity_provider
-	ADD COLUMN auto_sign_up BOOLEAN NOT NULL DEFAULT FALSE;

package/src/migrations/2022-07-07-135000-person-email-opt-uniq.sql

@@ -1,3 +0,0 @@
-ALTER TABLE person
-	ALTER email DROP NOT NULL,
-	ADD CONSTRAINT email_unique UNIQUE (email);

package/src/migrations/2022-07-07-141000-person-display-name.sql

@@ -1,4 +0,0 @@
-ALTER TABLE person
-	ADD name TEXT;
-UPDATE person
-SET name = SPLIT_PART(email, '@', 1);

package/src/model/service/idp/OIDCProvider.ts

@@ -1,100 +0,0 @@
-import * as Typesafe from '@contember/typesafe'
-import { Client, custom, errors, generators, Issuer, ResponseType } from 'openid-client'
-import { IDPResponseError } from './IDPResponseError'
-import { IdentityProviderHandler, IDPClaim, IDPResponse, InitIDPAuthResult } from './IdentityProviderHandler'
-import { IDPValidationError } from './IDPValidationError'
-import { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError'
-
-custom.setHttpOptionsDefaults({
-	timeout: 5000,
-})
-
-export type OIDCConfiguration = ReturnType<typeof OIDCConfigurationSchema>
-
-export interface SessionData {
-	nonce: string
-	state: string
-}
-
-const OIDCConfigurationSchema = Typesafe.intersection(
-	Typesafe.object({
-		url: Typesafe.string,
-		clientId: Typesafe.string,
-		clientSecret: Typesafe.string,
-	}),
-	Typesafe.partial({
-		responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
-		claims: Typesafe.string,
-	}),
-)
-
-export class OIDCProvider implements IdentityProviderHandler<SessionData, OIDCConfiguration> {
-	private issuerCache: Record<string, Issuer<Client>> = {}
-
-	public async initAuth(
-		configuration: OIDCConfiguration,
-		redirectUrl: string,
-	): Promise<InitIDPAuthResult<SessionData>> {
-		const client = await this.createOIDCClient(configuration)
-		const nonce = generators.nonce()
-		const state = generators.state()
-		const url = client.authorizationUrl({
-			redirect_uri: redirectUrl,
-			scope: configuration.claims ?? 'openid email',
-			nonce,
-			state,
-		})
-		return {
-			authUrl: url,
-			sessionData: { nonce, state },
-		}
-	}
-
-	public async processResponse(
-		configuration: OIDCConfiguration,
-		redirectUrl: string,
-		idpResponse: IDPResponse,
-		sessionData: SessionData,
-	): Promise<IDPClaim> {
-		const client = await this.createOIDCClient(configuration)
-		const params = client.callbackParams(idpResponse.url)
-		try {
-			const result = await client.callback(redirectUrl, params, sessionData)
-			const claims = result.claims()
-			return {
-				externalIdentifier: claims.sub,
-				email: claims.email,
-				name: claims.name,
-			}
-		} catch (e) {
-			if (e instanceof errors.RPError) {
-				throw new IDPValidationError(e.message)
-			}
-			if (e instanceof errors.OPError) {
-				throw new IDPResponseError(e.message)
-			}
-			throw e
-		}
-	}
-
-	public validateConfiguration(config: unknown): OIDCConfiguration {
-		try {
-			return OIDCConfigurationSchema(config)
-		} catch (e) {
-			if (e instanceof Typesafe.ParseError) {
-				throw new InvalidIDPConfigurationError(e.message)
-			}
-			throw e
-		}
-	}
-
-	private async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {
-		this.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)
-
-		return new this.issuerCache[configuration.url].Client({
-			client_id: configuration.clientId,
-			client_secret: configuration.clientSecret,
-			response_types: [configuration.responseType || 'code'],
-		})
-	}
-}