@contember/engine-tenant-api 1.3.0-rc.1 → 1.3.0-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "1.3.0-rc.1",
+  "version": "1.3.0-rc.2",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -13,16 +13,16 @@
     "test": "vitest --dir ./tests/cases --no-threads"
   },
   "dependencies": {
-    "@contember/authorization": "1.3.0-rc.1",
-    "@contember/config-loader": "1.3.0-rc.1",
-    "@contember/database": "1.3.0-rc.1",
-    "@contember/database-migrations": "1.3.0-rc.1",
-    "@contember/dic": "1.3.0-rc.1",
-    "@contember/graphql-utils": "1.3.0-rc.1",
-    "@contember/logger": "1.3.0-rc.1",
-    "@contember/schema": "1.3.0-rc.1",
-    "@contember/schema-utils": "1.3.0-rc.1",
-    "@contember/typesafe": "1.3.0-rc.1",
+    "@contember/authorization": "1.3.0-rc.2",
+    "@contember/config-loader": "1.3.0-rc.2",
+    "@contember/database": "1.3.0-rc.2",
+    "@contember/database-migrations": "1.3.0-rc.2",
+    "@contember/dic": "1.3.0-rc.2",
+    "@contember/graphql-utils": "1.3.0-rc.2",
+    "@contember/logger": "1.3.0-rc.2",
+    "@contember/schema": "1.3.0-rc.2",
+    "@contember/schema-utils": "1.3.0-rc.2",
+    "@contember/typesafe": "1.3.0-rc.2",
     "@graphql-tools/utils": "^8.6.13",
     "graphql-tag": "^2.12.5",
     "jose": "^4.10",
@@ -32,7 +32,7 @@
     "otpauth": "^7.0.6"
   },
   "devDependencies": {
-    "@contember/database-tester": "1.3.0-rc.1",
+    "@contember/database-tester": "1.3.0-rc.2",
     "@graphql-codegen/cli": "^2.6.2",
     "@graphql-codegen/typescript": "^2.5.1",
     "@graphql-codegen/typescript-operations": "^2.4.2",

package/src/TenantContainer.ts

@@ -183,8 +183,8 @@ export class TenantContainerFactory {
 				new SignInManager(apiKeyManager, providers, otpAuthenticator))
 			.addService('membershipValidator', ({ projectSchemaResolver }) =>
 				new MembershipValidator(projectSchemaResolver))
-			.addService('inviteManager', ({ providers, userMailer }) =>
-				new InviteManager(providers, userMailer))
+			.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) =>
+				new InviteManager(providers, userMailer, projectSchemaResolver))
 			.addService('otpManager', ({ otpAuthenticator }) =>
 				new OtpManager(otpAuthenticator))
 			.addService('mailTemplateManager', () =>

package/src/model/authorization/Identity.ts

@@ -22,6 +22,8 @@ export class StaticIdentity implements Identity {
 }
 
 export class ProjectAwareIdentity implements Identity {
+	private projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}
+
 	constructor(
 		public readonly id: string,
 		public readonly roles: readonly string[],
@@ -30,6 +32,7 @@ export class ProjectAwareIdentity implements Identity {
 	) {}
 
 	async getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {
-		return await this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)
+		this.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)
+		return await this.projectMembershipCache[projectSlug]
 	}
 }

package/src/model/authorization/PermissionActions.ts

@@ -4,6 +4,7 @@ import { Acl } from '@contember/schema'
 namespace PermissionActions {
 	export enum Resources {
 		system = 'system',
+		entrypoint = 'entrypoint',
 		person = 'person',
 		identity = 'identity',
 		project = 'project',
@@ -37,6 +38,7 @@ namespace PermissionActions {
 	export const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')
 
 	export const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')
+	export const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')
 
 	export const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'viewMembers', { memberships })
 	export const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'addMember', { memberships })

package/src/model/authorization/PermissionsFactory.ts

@@ -2,7 +2,7 @@ import { Permissions } from '@contember/authorization'
 import { PermissionActions } from './PermissionActions'
 import { TenantRole } from './Roles'
 
-const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN])
+const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])
 
 const projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {
 	return roles === undefined || roles.every(it => allowedRoles.has(it))
@@ -58,7 +58,10 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)
 
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)
+
 		permissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)
+		permissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)
 
 		return permissions
 	}

package/src/model/authorization/Roles.ts

@@ -6,4 +6,5 @@ export enum TenantRole {
 	PROJECT_CREATOR = 'project_creator',
 	PROJECT_MEMBER = 'project_member',
 	PROJECT_ADMIN = 'project_admin',
+	ENTRYPOINT_DEPLOYER = 'entrypoint_deployer',
 }

package/src/model/service/InviteManager.ts

@@ -7,7 +7,7 @@ import {
 } from '../commands'
 import { Providers } from '../providers'
 import { PersonQuery, PersonRow } from '../queries'
-import { Project } from '../type'
+import { Project, ProjectSchemaResolver } from '../type'
 import { InviteErrorCode, InviteMethod } from '../../schema'
 import { TenantRole } from '../authorization'
 import { UserMailer } from '../mailing'
@@ -35,6 +35,7 @@ export class InviteManager {
 	constructor(
 		private readonly providers: Providers,
 		private readonly mailer: UserMailer,
+		private readonly projectSchemaResolver: ProjectSchemaResolver,
 	) {}
 
 	async invite(
@@ -70,11 +71,11 @@ export class InviteManager {
 					password: passwordWrapper,
 				}))
 				if (method === 'RESET_PASSWORD') {
-					const result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand(person.id, INVITATION_RESET_TOKEN_EXPIRATION_MINUTES))
+					const result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand(person.id, await this.getInviteExpiration(project.slug)))
 					resetToken = result.token
 				}
 				if (passwordResetTokenHash) {
-					await trx.commandBus.execute(new SavePasswordResetRequestCommand(person.id, passwordResetTokenHash, INVITATION_RESET_TOKEN_EXPIRATION_MINUTES))
+					await trx.commandBus.execute(new SavePasswordResetRequestCommand(person.id, passwordResetTokenHash, await this.getInviteExpiration(project.slug)))
 				}
 			}
 			for (const membershipUpdate of createAppendMembershipVariables(memberships)) {
@@ -98,6 +99,12 @@ export class InviteManager {
 			return new ResponseOk(new InviteResult(person, isNew))
 		})
 	}
+
+	private async getInviteExpiration(projectSlug: string): Promise<number> {
+		const schema = await this.projectSchemaResolver.getSchema(projectSlug)
+
+		return schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES
+	}
 }
 
 export type InviteResponse = Response<InviteResult, InviteErrorCode>

package/src/model/service/ProjectMemberManager.ts

@@ -114,24 +114,23 @@ export class ProjectMemberManager {
 		memberships: readonly T[],
 		verifier: AccessVerifier,
 	): Promise<T[]> {
-		const filteredMemberships = await Promise.all(
-			memberships.map(async membership => {
-				if (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {
-					return null
-				}
-				const variables = await Promise.all(
-					membership.variables.map(async variable => {
-						const values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)
-						return { name: variable.name, values }
-					}),
-				)
-				if (variables.find(it => it.values.length === 0)) {
-					return null
+		const filteredMemberships: T[] = []
+		nextMembership: for (const membership of memberships) {
+			if (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {
+				continue
+			}
+			const variables: { values: Acl.MembershipVariable['values']; name: string }[] = []
+			for (const variable of membership.variables) {
+				const values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)
+				if (values.length === 0) {
+					continue nextMembership
 				}
-				return { ...membership, variables }
-			}),
-		)
-		return filteredMemberships.filter(notEmpty)
+				variables.push({ name: variable.name, values })
+			}
+			filteredMemberships.push({ ...membership, variables })
+		}
+
+		return filteredMemberships
 	}
 
 	private async filterProjectMembershipVariableValues(

package/src/resolvers/types/IdentityTypeResolver.ts

@@ -117,6 +117,7 @@ export class IdentityTypeResolver implements IdentityResolvers {
 		if (parent.permissions) {
 			return parent.permissions
 		}
+
 		const permissionsContext = await (async () => {
 			const isSelf = parent.id === context.identity.id
 			if (isSelf) {
@@ -128,13 +129,14 @@ export class IdentityTypeResolver implements IdentityResolvers {
 			}
 			return this.permissionContextFactory.create(context.db, { id: parent.id, roles })
 		})()
+
 		if (!permissionsContext) {
 			return null
 		}
+
 		return {
 			canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
+			canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
 		}
 	}
-
-
 }

package/src/schema/index.ts

@@ -405,6 +405,7 @@ export type Identity = {
 export type IdentityGlobalPermissions = {
 	readonly __typename?: 'IdentityGlobalPermissions'
 	readonly canCreateProject: Scalars['Boolean']
+	readonly canDeployEntrypoint: Scalars['Boolean']
 }
 
 export type IdentityProjectRelation = {
@@ -1812,6 +1813,7 @@ export type IdentityResolvers<ContextType = any, ParentType extends ResolversPar
 
 export type IdentityGlobalPermissionsResolvers<ContextType = any, ParentType extends ResolversParentTypes['IdentityGlobalPermissions'] = ResolversParentTypes['IdentityGlobalPermissions']> = {
 	canCreateProject?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canDeployEntrypoint?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 

package/src/schema/tenant.graphql.ts

@@ -546,7 +546,6 @@ const schema: DocumentNode = gql`
 	type AddGlobalIdentityRolesResult {
 		identity: Identity!
 	}
-
 	type AddGlobalIdentityRolesError {
 		code: AddGlobalIdentityRolesErrorCode!
 		developerMessage: String!
@@ -655,6 +654,7 @@ const schema: DocumentNode = gql`
 
 	type IdentityGlobalPermissions {
 		canCreateProject: Boolean!
+		canDeployEntrypoint: Boolean!
 	}
 
 	type IdentityProjectRelation {