@contember/engine-tenant-api 1.3.0-alpha.8 → 1.3.0-beta.1

package/src/model/queries/person/PersonQuery.ts

@@ -1,6 +1,7 @@
-import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilderSpecification } from '@contember/database'
+import { DatabaseQuery, DatabaseQueryable, Literal, Operator, SelectBuilderSpecification } from '@contember/database'
 import { MaybePersonRow } from './types'
 import { PersonQueryBuilderFactory } from './PersonQueryBuilderFactory'
+import { normalizeEmail } from '../../utils/email'
 
 export type PersonUniqueIdentifier =
 	| { type: 'id'; id: string }
@@ -12,7 +13,7 @@ class PersonQuery extends DatabaseQuery<MaybePersonRow> {
 		super()
 	}
 
-	static byUniqueIdentifier(identifier: PersonUniqueIdentifier): PersonQuery {
+	static byUniqueIdentifier(identifier: PersonUniqueIdentifier): DatabaseQuery<MaybePersonRow> {
 		switch (identifier.type) {
 			case 'email':
 				return PersonQuery.byEmail(identifier.email)
@@ -27,7 +28,11 @@ class PersonQuery extends DatabaseQuery<MaybePersonRow> {
 		return new PersonQuery(qb => qb.where(it => it.compare(['person', 'id'], Operator.eq, id)))
 	}
 
-	static byEmail(email: string): PersonQuery {
+	static byEmail(email: string): DatabaseQuery<MaybePersonRow> {
+		return new PersonByEmailFallbackQuery(email)
+	}
+
+	static byExactEmail(email: string): PersonQuery {
 		return new PersonQuery(qb => qb.where(it => it.compare(['person', 'email'], Operator.eq, email)))
 	}
 
@@ -44,4 +49,26 @@ class PersonQuery extends DatabaseQuery<MaybePersonRow> {
 	}
 }
 
+class PersonByEmailFallbackQuery extends DatabaseQuery<MaybePersonRow> {
+	constructor(
+		private readonly email: string,
+	) {
+		super()
+	}
+
+	async fetch(ctx: DatabaseQueryable): Promise<MaybePersonRow> {
+		const handler = ctx.getHandler()
+		const exact = await handler.fetch(PersonQuery.byExactEmail(this.email))
+		if (exact) {
+			return exact
+		}
+		const normalizedEmail = normalizeEmail(this.email)
+		if (normalizedEmail === this.email) {
+			return null
+		}
+		return await handler.fetch(PersonQuery.byExactEmail(normalizedEmail))
+	}
+
+}
+
 export { PersonQuery }

package/src/model/queries/person/PersonQueryBuilderFactory.ts

@@ -11,6 +11,7 @@ export class PersonQueryBuilderFactory {
 			.select(['person', 'identity_id'])
 			.select(['person', 'email'])
 			.select(['person', 'name'])
+			.select(['person', 'disabled_at'])
 			.select(['identity', 'roles'])
 			.from('person')
 			.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))

package/src/model/queries/person/types.ts

@@ -4,9 +4,10 @@ export interface PersonRow {
 	readonly identity_id: string
 	readonly otp_uri: string | null
 	readonly otp_activated_at: Date | null
-	readonly email?: string
-	readonly name?: string
+	readonly email: string | null
+	readonly name: string | null
 	readonly roles: string[]
+	readonly disabled_at: Date | null
 }
 
 export type MaybePersonRow = PersonRow | null

package/src/model/service/IDPSignInManager.ts

@@ -21,7 +21,7 @@ class IDPSignInManager {
 		responseData: unknown,
 		expiration?: number,
 	): Promise<IDPSignInManager.SignInIDPResponse> {
-		return dbContext.transaction(async db => {
+		return dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {
 			const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))
 			if (!provider || provider.disabledAt) {
 				throw new Error('provider not found')
@@ -36,16 +36,21 @@ class IDPSignInManager {
 				)
 			} catch (e) {
 				if (e instanceof IDPResponseError) {
-					return new ResponseError(SignInIdpErrorCode.InvalidIdpResponse, e.message)
+					return new ResponseError('INVALID_IDP_RESPONSE', e.message)
 				}
 				if (e instanceof IDPValidationError) {
-					return new ResponseError(SignInIdpErrorCode.IdpValidationFailed, e.message)
+					return new ResponseError('IDP_VALIDATION_FAILED', e.message)
 				}
 				throw e
 			}
 			const personRow = await this.resolvePerson(db, claim, provider)
+
 			if (!personRow) {
-				return new ResponseError(SignInIdpErrorCode.PersonNotFound, `Person ${claim.email} not found`)
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`)
+			}
+
+			if (personRow.disabled_at !== null) {
+				return new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`)
 			}
 
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
@@ -56,7 +61,7 @@ class IDPSignInManager {
 	async initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {
 		const provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))
 		if (!provider || provider.disabledAt) {
-			return new ResponseError(InitSignInIdpErrorCode.ProviderNotFound, `Identity provider ${idpSlug} not found`)
+			return new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)
 		}
 		const providerService = this.idpRegistry.getHandler(provider.type)
 		const validatedConfig = providerService.validateConfiguration(provider.configuration)
@@ -65,7 +70,7 @@ class IDPSignInManager {
 			return new ResponseOk(initResponse)
 		} catch (e) {
 			if (e instanceof IDPValidationError) {
-				return new ResponseError(InitSignInIdpErrorCode.IdpValidationFailed, e.message)
+				return new ResponseError('IDP_VALIDATION_FAILED', e.message)
 			}
 			throw e
 		}

package/src/model/service/InviteManager.ts

@@ -60,7 +60,7 @@ export class InviteManager {
 				const identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))
 
 				generatedPassword = password ??
-					(method === InviteMethod.CreatePassword ? (await this.providers.randomBytes(9)).toString('base64') : null)
+					(method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)
 				const passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword
 
 				person = await trx.commandBus.execute(new CreatePersonCommand({
@@ -69,7 +69,7 @@ export class InviteManager {
 					name,
 					password: passwordWrapper,
 				}))
-				if (method === InviteMethod.ResetPassword) {
+				if (method === 'RESET_PASSWORD') {
 					const result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand(person.id, INVITATION_RESET_TOKEN_EXPIRATION_MINUTES))
 					resetToken = result.token
 				}

package/src/model/service/PasswordChangeManager.ts

@@ -14,7 +14,7 @@ class PasswordChangeManager {
 	async changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {
 		const weakPassword = getPasswordWeaknessMessage(password)
 		if (weakPassword) {
-			return new ResponseError(ChangePasswordErrorCode.TooWeak, weakPassword)
+			return new ResponseError('TOO_WEAK', weakPassword)
 		}
 		await dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))
 		return new ResponseOk(null)
@@ -23,13 +23,13 @@ class PasswordChangeManager {
 	async changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {
 		const weakPassword = getPasswordWeaknessMessage(password)
 		if (weakPassword) {
-			return new ResponseError(ChangeMyPasswordErrorCode.TooWeak, weakPassword)
+			return new ResponseError('TOO_WEAK', weakPassword)
 		}
 		if (!person.password_hash) {
-			return new ResponseError(ChangeMyPasswordErrorCode.NoPasswordSet, 'No password set')
+			return new ResponseError('NO_PASSWORD_SET', 'No password set')
 		}
 		if (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {
-			return new ResponseError(ChangeMyPasswordErrorCode.InvalidPassword, 'Password does not match')
+			return new ResponseError('INVALID_PASSWORD', 'Password does not match')
 		}
 
 		await dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))

package/src/model/service/PasswordResetManager.ts

@@ -56,14 +56,12 @@ export class PasswordResetManager {
 	public async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {
 		const weakPassword = getPasswordWeaknessMessage(password)
 		if (weakPassword) {
-			return new ResponseError(ResetPasswordErrorCode.PASSWORD_TOO_WEAK, weakPassword)
+			return new ResponseError('PASSWORD_TOO_WEAK', weakPassword)
 		}
 		return await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))
 	}
 }
 
-export enum ResetPasswordErrorCode {
-	PASSWORD_TOO_WEAK = 'PASSWORD_TOO_WEAK',
-}
+export type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'
 
-export type ResetPasswordResponse = Response<undefined, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>
+export type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>

package/src/model/service/PersonAccessManager.ts

@@ -0,0 +1,56 @@
+import { PersonQuery } from '../queries'
+import { DatabaseContext } from '../utils'
+import { DisablePersonCommand } from '../commands/person/DisablePersonCommand'
+import { ApiKeyManager } from './apiKey'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import { DisablePersonErrorCode } from '../../schema'
+
+class PersonAccessManager {
+
+	constructor(private readonly apiKeyManager: ApiKeyManager) {}
+
+	async disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {
+		const result = await dbContext.transaction(async trx => {
+			const personRow = await trx.queryHandler.fetch(
+				PersonQuery.byId(personId),
+			)
+
+			if (personRow === null) {
+				return 'PERSON_NOT_FOUND'
+			}
+
+			if (personRow.disabled_at !== null) {
+				return 'PERSON_ALREADY_DISABLED'
+			}
+
+			// Deactivate person & invalidate all api keys associated with person identity
+			await this.disablePersonAccount(trx, personRow.id)
+			await this.disableIdentityApiKeys(trx, personRow.identity_id)
+
+			return null
+		})
+
+		switch (result) {
+			case null:
+				return new ResponseOk(null)
+
+			case 'PERSON_ALREADY_DISABLED':
+				return new ResponseError(result, 'Person is already disable')
+
+			case 'PERSON_NOT_FOUND':
+				return new ResponseError(result, 'Person not found')
+		}
+	}
+
+	private async disablePersonAccount(dbContext: DatabaseContext, personId: string) {
+		await dbContext.commandBus.execute(new DisablePersonCommand(personId))
+	}
+
+	private async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {
+		await this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)
+	}
+}
+
+export type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>
+
+export { PersonAccessManager }

package/src/model/service/PersonManager.ts

@@ -0,0 +1,14 @@
+import { PersonQuery, PersonRow } from '../queries'
+import { DatabaseContext } from '../utils'
+
+class PersonManager {
+
+	async findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {
+		return await dbContext.queryHandler.fetch(
+			PersonQuery.byId(personId),
+		)
+	}
+
+}
+
+export { PersonManager }

package/src/model/service/ProjectManager.ts

@@ -34,13 +34,13 @@ export class ProjectManager {
 			noDeployToken?: boolean
 		},
 	): Promise<CreateProjectResponse> {
-		return await dbContext.transaction(async db => {
+		return await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {
 			const bus = db.commandBus
 
 			const now = db.providers.now()
 			const projectId = await bus.execute(new CreateProjectCommand(project, now))
 			if (!projectId) {
-				return new ResponseError(CreateProjectResponseErrorCode.AlreadyExists, `Project ${project.slug} already exists`)
+				return new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)
 			}
 			for (const [key, value] of Object.entries(project.secrets)) {
 				await bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))
@@ -70,7 +70,7 @@ export class ProjectManager {
 				logger.error(e, { message: 'Project initialization failed' })
 				await db.client.connection.rollback()
 				return new ResponseError(
-					CreateProjectResponseErrorCode.InitError,
+					'INIT_ERROR',
 					`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,
 				)
 			}

package/src/model/service/ProjectMemberManager.ts

@@ -1,6 +1,5 @@
 import {
 	AddProjectMemberCommand,
-	AddProjectMemberCommandError,
 	MembershipUpdateInput,
 	RemoveProjectMemberCommand,
 	RemoveProjectMemberResponse,
@@ -8,12 +7,12 @@ import {
 	UpdateProjectMemberResponse,
 } from '../commands'
 import { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'
-import { AddProjectMemberErrorCode, MemberType, ProjectMembersInput } from '../../schema'
+import { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema'
 import { AccessVerifier, PermissionActions, TenantRole } from '../authorization'
 import { indexListBy, notEmpty } from '../../utils/array'
 import { createSetMembershipVariables } from './membershipUtils'
 import { Acl, ProjectRole } from '@contember/schema'
-import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import { Response } from '../utils/Response'
 import { DatabaseContext } from '../utils'
 
 export class ProjectMemberManager {
@@ -24,20 +23,9 @@ export class ProjectMemberManager {
 		memberships: readonly Acl.Membership[],
 	): Promise<AddProjectMemberResponse> {
 		return await dbContext.transaction(async db => {
-			const result = await db.commandBus.execute(
+			return await db.commandBus.execute(
 				new AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),
 			)
-			if (result.ok) {
-				return new ResponseOk(null)
-			}
-			switch (result.error) {
-				case AddProjectMemberCommandError.alreadyMember:
-					return new ResponseError(AddProjectMemberErrorCode.AlreadyMember, result.errorMessage)
-				case AddProjectMemberCommandError.projectNotFound:
-					return new ResponseError(AddProjectMemberErrorCode.ProjectNotFound, result.errorMessage)
-				case AddProjectMemberCommandError.identityNotfound:
-					return new ResponseError(AddProjectMemberErrorCode.IdentityNotFound, result.errorMessage)
-			}
 		})
 	}
 

package/src/model/service/RolesManager.ts

@@ -0,0 +1,40 @@
+import { DatabaseContext } from '../utils'
+import { PatchIdentityGlobalRoles } from '../commands'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import { TenantRole } from '../authorization'
+
+export class RolesManager {
+	async addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
+		return this.patchGlobalRoles(dbContext, identityId, roles, [])
+	}
+
+	async removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
+		return this.patchGlobalRoles(dbContext, identityId, [], roles)
+	}
+
+	private async patchGlobalRoles(dbContext: DatabaseContext, identityId: string, addRoles: readonly string[], removeRoles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
+		const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])
+		if (rolesValidationError) {
+			return rolesValidationError
+		}
+		const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))
+		if (!result) {
+			return new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)
+		}
+		return new ResponseOk(null)
+	}
+
+
+	private validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {
+		for (const role of roles) {
+			if (!Object.values(TenantRole).includes(role as TenantRole)) {
+				return new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)
+			}
+		}
+		return null
+	}
+}
+
+type GlobalRolesErrorCode =
+	| 'IDENTITY_NOT_FOUND'
+	| 'INVALID_ROLE'

package/src/model/service/SignInManager.ts

@@ -15,26 +15,37 @@ class SignInManager {
 
 	async signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {
 		const personRow = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))
+
 		if (personRow === null) {
-			return new ResponseError(SignInErrorCode.UnknownEmail, `Person with email ${email} not found`)
+			return new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`)
 		}
+
 		if (!personRow.password_hash) {
-			return new ResponseError(SignInErrorCode.NoPasswordSet, `No password set`)
+			return new ResponseError('NO_PASSWORD_SET', `No password set`)
+		}
+
+		if (personRow.disabled_at !== null) {
+			return new ResponseError('PERSON_DISABLED', `Person is disabled`)
 		}
+
 		const passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash)
+
 		if (!passwordValid) {
-			return new ResponseError(SignInErrorCode.InvalidPassword, `Password does not match`)
+			return new ResponseError('INVALID_PASSWORD', `Password does not match`)
 		}
+
 		if (personRow.otp_uri && personRow.otp_activated_at) {
 			if (!otpCode) {
-				return new ResponseError(SignInErrorCode.OtpRequired, `2FA is enabled. OTP token is required`)
+				return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
 			}
+
 			if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {
-				return new ResponseError(SignInErrorCode.InvalidOtpToken, 'OTP token validation has failed')
+				return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
 			}
 		}
 
 		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)
+
 		return new ResponseOk(new SignInResult(personRow, sessionToken))
 	}
 
@@ -45,15 +56,22 @@ class SignInManager {
 		verifier?: (person: PersonRow) => Promise<void>,
 	): Promise<CreateSessionTokenResponse> {
 		const personRow = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))
+
 		if (personRow === null) {
 			if (personIdentifier.type === 'email') {
-				return new ResponseError(CreateSessionTokenErrorCode.UnknownEmail, `Person with email ${personIdentifier.email} not found`)
+				return new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`)
 
 			} else if (personIdentifier.type === 'id') {
-				return new ResponseError(CreateSessionTokenErrorCode.UnknownPersonId, `Person with id ${personIdentifier.id} not found`)
+				return new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`)
 			}
+
 			throw new ImplementationException()
 		}
+
+		if (personRow.disabled_at !== null) {
+			return new ResponseError('PERSON_DISABLED', `Person with id ${personRow.id} is disabled`)
+		}
+
 		await verifier?.(personRow)
 
 		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)

package/src/model/service/SignUpManager.ts

@@ -17,12 +17,12 @@ type SignUpUser = {
 export class SignUpManager {
 	async signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {
 		if (await this.isEmailAlreadyUsed(dbContext, email)) {
-			return new ResponseError(SignUpErrorCode.EmailAlreadyExists, `User with email ${email} already exists`)
+			return new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)
 		}
 		const plainPassword = password.getPlain()
 		const weakPassword = plainPassword ? getPasswordWeaknessMessage(plainPassword) : null
 		if (weakPassword) {
-			return new ResponseError(SignUpErrorCode.TooWeak, weakPassword)
+			return new ResponseError('TOO_WEAK', weakPassword)
 		}
 		const person = await dbContext.transaction(async db => {
 			const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))

package/src/model/service/apiKey/ApiKeyManager.ts

@@ -6,12 +6,13 @@ import {
 	ProlongApiKeyCommand,
 } from '../../commands'
 import { ApiKey } from '../../type'
-import { ApiKeyByTokenQuery } from '../../queries'
+
 import { Response, ResponseError, ResponseOk } from '../../utils/Response'
 import { DatabaseContext, TokenHash } from '../../utils'
 import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'
 import assert from 'node:assert'
 import { Acl } from '@contember/schema'
+import { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow } from '../../queries'
 
 export class ApiKeyManager {
 	constructor(
@@ -56,6 +57,12 @@ export class ApiKeyManager {
 	}
 
 
+	async findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {
+		return await dbContext.queryHandler.fetch(
+			new ApiKeyByIdQuery(apiKeyId),
+		)
+	}
+
 	async disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {
 		await dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))
 	}

package/src/model/service/idp/IDPManager.ts

@@ -18,23 +18,23 @@ export class IDPManager {
 	}
 
 	public async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {
-		return await db.transaction(async db => {
+		return await db.transaction(async (db): Promise<RegisterIDPResponse> => {
 			try {
 				const providerService = this.idpRegistry.getHandler(idp.type)
 				providerService.validateConfiguration(idp.configuration)
 			} catch (e) {
 				if (e instanceof IdentityProviderNotFoundError) {
-					return new ResponseError(AddIdpErrorCode.UnknownType, `IDP type ${idp.type} not found`)
+					return new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)
 				}
 				if (e instanceof InvalidIDPConfigurationError) {
-					return new ResponseError(AddIdpErrorCode.InvalidConfiguration, `Invalid IDP configuration: ${e.message}`)
+					return new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)
 				}
 				throw e
 			}
 
 			const existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))
 			if (existing) {
-				return new ResponseError(AddIdpErrorCode.AlreadyExists, `IDP with slug ${idp.slug} already exists`)
+				return new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)
 			}
 			await db.commandBus.execute(new CreateIdpCommand(idp))
 			return new ResponseOk(null)
@@ -45,7 +45,7 @@ export class IDPManager {
 		return await db.transaction(async db => {
 			const existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))
 			if (!existing) {
-				return new ResponseError(DisableIdpErrorCode.NotFound, `IDP ${slug} not found`)
+				return new ResponseError('NOT_FOUND', `IDP ${slug} not found`)
 			}
 			if (!existing.disabledAt) {
 				await db.commandBus.execute(new DisableIdpCommand(existing.id))
@@ -59,7 +59,7 @@ export class IDPManager {
 		return await db.transaction(async db => {
 			const existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))
 			if (!existing) {
-				return new ResponseError(EnableIdpErrorCode.NotFound, `IDP ${slug} not found`)
+				return new ResponseError('NOT_FOUND', `IDP ${slug} not found`)
 			}
 			if (existing.disabledAt) {
 				await db.commandBus.execute(new EnableIdpCommand(existing.id))
@@ -72,7 +72,7 @@ export class IDPManager {
 		return await db.transaction(async db => {
 			const existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))
 			if (!existing) {
-				return new ResponseError(UpdateIdpErrorCode.NotFound, `IDP ${slug} not found`)
+				return new ResponseError('NOT_FOUND', `IDP ${slug} not found`)
 			}
 			try {
 				const type = data.type ?? existing.type
@@ -83,7 +83,7 @@ export class IDPManager {
 				}
 			} catch (e) {
 				if (e instanceof InvalidIDPConfigurationError) {
-					return new ResponseError(UpdateIdpErrorCode.InvalidConfiguration, `Invalid IDP configuration: ${e.message}`)
+					return new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)
 				}
 				throw e
 			}

package/src/model/service/index.ts

@@ -8,8 +8,10 @@ export * from './OtpManager'
 export * from './PasswordChangeManager'
 export * from './ProjectManager'
 export * from './ProjectMemberManager'
+export * from './RolesManager'
 export * from './SignInManager'
 export * from './SignUpManager'
 export * from './PasswordResetManager'
 export * from './SecretsManager'
 export * from './OtpAuthenticator'
+export * from './PersonAccessManager'

package/src/model/utils/Response.ts

@@ -6,7 +6,7 @@ export class ResponseOk<Result> {
 	constructor(public readonly result: Result) {}
 }
 
-export class ResponseError<Error> {
+export class ResponseError<const Error> {
 	public readonly ok = false
 
 	constructor(public readonly error: Error, public readonly errorMessage: string) {}

package/src/model/utils/email.ts

@@ -0,0 +1,5 @@
+import { Literal } from '@contember/database'
+
+export const normalizeEmail = (email: string) => {
+	return email.replaceAll(/\s/g, '').toLocaleLowerCase()
+}

package/src/resolvers/ResolverFactory.ts

@@ -15,7 +15,7 @@ import {
 	SignOutMutationResolver,
 	SignUpMutationResolver,
 	UpdateProjectMemberMutationResolver,
-	UpdateProjectMutationResolver,
+	UpdateProjectMutationResolver, IdentityGlobalRolesMutationResolver,
 } from './mutation'
 
 import { Resolvers } from '../schema'
@@ -24,6 +24,7 @@ import { IdentityTypeResolver, ProjectTypeResolver } from './types'
 import { DateTimeType, JSONType } from '@contember/graphql-utils'
 import { IDPQueryResolver } from './query/IDPQueryResolver'
 import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver'
+import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver'
 
 class ResolverFactory {
 	public constructor(
@@ -44,6 +45,8 @@ class ResolverFactory {
 			enableIdpMutationResolver: EnableIDPMutationResolver
 			updateIdpMutationResolver: UpdateIDPMutationResolver
 
+			disablePersonMutationResolver: DisablePersonMutationResolver
+
 			inviteMutationResolver: InviteMutationResolver
 			addProjectMemberMutationResolver: AddProjectMemberMutationResolver
 			updateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver
@@ -63,6 +66,8 @@ class ResolverFactory {
 			identityTypeResolver: IdentityTypeResolver
 			projectTypeResolver: ProjectTypeResolver
 
+			identityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver
+
 		},
 	) {}
 
@@ -107,6 +112,7 @@ class ResolverFactory {
 				disableIDP: this.resolvers.disableIdpMutationResolver.disableIDP.bind(this.resolvers.disableIdpMutationResolver),
 				enableIDP: this.resolvers.enableIdpMutationResolver.enableIDP.bind(this.resolvers.enableIdpMutationResolver),
 				updateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),
+				disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
 
 				invite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),
 				unmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),
@@ -132,6 +138,9 @@ class ResolverFactory {
 				createProject: this.resolvers.createProjectMutationResolver.createProject.bind(this.resolvers.createProjectMutationResolver),
 				updateProject: this.resolvers.updateProjectMutationResolver.updateProject.bind(this.resolvers.updateProjectMutationResolver),
 				setProjectSecret: this.resolvers.setProjectSecretMutationResolver.setProjectSecret.bind(this.resolvers.setProjectSecretMutationResolver),
+
+				addGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(this.resolvers.identityGlobalRolesMutationResolver),
+				removeGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(this.resolvers.identityGlobalRolesMutationResolver),
 			},
 		}
 	}

package/src/resolvers/errorUtils.ts

@@ -4,5 +4,5 @@ export const createErrorResponse = <T>(code: T, developerMessage: string): Error
 	const error = { code, developerMessage }
 	return { ok: false, error, errors: [error] }
 }
-export const createProjectNotFoundResponse = <T>(code: T, projectSlug: string): ErrorResponse<T> =>
+export const createProjectNotFoundResponse = <const T>(code: T, projectSlug: string): ErrorResponse<T> =>
 	createErrorResponse(code, `Project ${projectSlug} was not found or you are not allowed to access it.`)