@contember/engine-tenant-api 1.3.0-rc.2 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "1.3.0-rc.2",
+  "version": "1.3.0",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -13,16 +13,16 @@
     "test": "vitest --dir ./tests/cases --no-threads"
   },
   "dependencies": {
-    "@contember/authorization": "1.3.0-rc.2",
-    "@contember/config-loader": "1.3.0-rc.2",
-    "@contember/database": "1.3.0-rc.2",
-    "@contember/database-migrations": "1.3.0-rc.2",
-    "@contember/dic": "1.3.0-rc.2",
-    "@contember/graphql-utils": "1.3.0-rc.2",
-    "@contember/logger": "1.3.0-rc.2",
-    "@contember/schema": "1.3.0-rc.2",
-    "@contember/schema-utils": "1.3.0-rc.2",
-    "@contember/typesafe": "1.3.0-rc.2",
+    "@contember/authorization": "1.3.0",
+    "@contember/config-loader": "1.3.0",
+    "@contember/database": "1.3.0",
+    "@contember/database-migrations": "1.3.0",
+    "@contember/dic": "1.3.0",
+    "@contember/graphql-utils": "1.3.0",
+    "@contember/logger": "1.3.0",
+    "@contember/schema": "1.3.0",
+    "@contember/schema-utils": "1.3.0",
+    "@contember/typesafe": "1.3.0",
     "@graphql-tools/utils": "^8.6.13",
     "graphql-tag": "^2.12.5",
     "jose": "^4.10",
@@ -32,7 +32,7 @@
     "otpauth": "^7.0.6"
   },
   "devDependencies": {
-    "@contember/database-tester": "1.3.0-rc.2",
+    "@contember/database-tester": "1.3.0",
     "@graphql-codegen/cli": "^2.6.2",
     "@graphql-codegen/typescript": "^2.5.1",
     "@graphql-codegen/typescript-operations": "^2.4.2",

package/src/model/authorization/AclSchemaAccessNodeFactory.ts

@@ -38,6 +38,12 @@ export class AclSchemaAccessNodeFactory {
 			node.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)
 			node.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)
 		}
+
+		if (membershipRoles.some(it => it.tenant?.view)) {
+			const verifier = createVerifier(it => it.view ?? {})
+			node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)
+		}
+
 		return node
 	}
 }

package/src/model/mailing/UserMailer.ts

@@ -11,11 +11,11 @@ export class UserMailer {
 	constructor(
 		private readonly mailer: Mailer,
 		private readonly templateRenderer: TemplateRenderer,
-	) {}
+	) { }
 
 	async sendNewUserInvitedMail(
 		dbContext: DatabaseContext,
-		mailArguments: { email: string; password: string | null; token: string | null; project: string },
+		mailArguments: { email: string; password: string | null; token: string | null; project: string; projectSlug: string },
 		customMailOptions: { projectId: string; variant: string },
 	): Promise<void> {
 		const template = (await this.getCustomTemplate(dbContext, { type: MailType.newUserInvited, ...customMailOptions })) || {
@@ -27,7 +27,7 @@ export class UserMailer {
 
 	async sendExistingUserInvitedEmail(
 		dbContext: DatabaseContext,
-		mailArguments: { email: string; project: string },
+		mailArguments: { email: string; project: string; projectSlug: string },
 		customMailOptions: { projectId: string; variant: string },
 	): Promise<void> {
 		const template = (await this.getCustomTemplate(dbContext, { type: MailType.existingUserInvited, ...customMailOptions })) || {
@@ -39,7 +39,7 @@ export class UserMailer {
 
 	async sendPasswordResetEmail(
 		dbContext: DatabaseContext,
-		mailArguments: { email: string; token: string; project?: string },
+		mailArguments: { email: string; token: string; project?: string; projectSlug?: string },
 		customMailOptions: { projectId?: string; variant: string },
 	): Promise<void> {
 		const template = (await this.getCustomTemplate(dbContext, { type: MailType.passwordReset, ...customMailOptions })) || {

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -23,22 +23,30 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 					.where({ project_id: this.projectId }),
 			))
 			.match(qb => {
-				const { email, memberType } = this.projectMemberInput.filter ?? {}
-				if (email && memberType === 'API_KEY') {
+				const identityId = this.projectMemberInput.filter?.identityId
+				return identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb
+			})
+			.match(qb => {
+				const { email, memberType, personId } = this.projectMemberInput.filter ?? {}
+				if ((email || personId) && memberType === 'API_KEY') {
 					throw new ImplementationException()
 				}
+
 				const personQuery = SelectBuilder.create()
 					.from('person')
 					.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))
-				if (email) {
-					return qb.where(it => it.exists(personQuery.where({ email })))
+					.match(qb => email ? qb.where(it => it.in('email', email)) : qb)
+					.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)
+
+
+				if (email || personId || memberType === 'PERSON') {
+					return qb.where(it => it.exists(personQuery))
 				}
-				switch (memberType) {
-					case 'API_KEY':
-						return qb.where(it => it.not(it => it.exists(personQuery)))
-					case 'PERSON':
-						return qb.where(it => it.exists(personQuery))
+
+				if (memberType === 'API_KEY') {
+					return qb.where(it => it.not(it => it.exists(personQuery)))
 				}
+
 				return qb
 			})
 			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)

package/src/model/service/InviteManager.ts

@@ -12,10 +12,11 @@ import { InviteErrorCode, InviteMethod } from '../../schema'
 import { TenantRole } from '../authorization'
 import { UserMailer } from '../mailing'
 import { createAppendMembershipVariables } from './membershipUtils'
-import { Response, ResponseOk } from '../utils/Response'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { DatabaseContext, TokenHash } from '../utils'
 import { NoPassword, PasswordPlain } from '../dtos'
 import { Acl } from '@contember/schema'
+import { validateEmail } from '../utils/email'
 
 export interface InviteData {
 	email: string
@@ -36,7 +37,7 @@ export class InviteManager {
 		private readonly providers: Providers,
 		private readonly mailer: UserMailer,
 		private readonly projectSchemaResolver: ProjectSchemaResolver,
-	) {}
+	) { }
 
 	async invite(
 		dbContext: DatabaseContext,
@@ -52,6 +53,10 @@ export class InviteManager {
 			passwordResetTokenHash,
 		}: InviteData,
 	): Promise<InviteResponse> {
+		if (!validateEmail(email.trim())) {
+			return new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')
+		}
+
 		return await dbContext.transaction(async trx => {
 			let person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))
 			const isNew = !person
@@ -89,11 +94,11 @@ export class InviteManager {
 				if (isNew) {
 					await this.mailer.sendNewUserInvitedMail(
 						trx,
-						{ email, project: project.name, password: generatedPassword, token: resetToken },
+						{ email, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken },
 						customMailOptions,
 					)
 				} else {
-					await this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name }, customMailOptions)
+					await this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name, projectSlug: project.slug }, customMailOptions)
 				}
 			}
 			return new ResponseOk(new InviteResult(person, isNew))
@@ -110,5 +115,5 @@ export class InviteManager {
 export type InviteResponse = Response<InviteResult, InviteErrorCode>
 
 export class InviteResult {
-	constructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) {}
+	constructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) { }
 }

package/src/model/service/PasswordResetManager.ts

@@ -17,7 +17,7 @@ export class PasswordResetManager {
 	constructor(
 		private readonly mailer: UserMailer,
 		private readonly projectManager: ProjectManager,
-	) {}
+	) { }
 
 	public async createPasswordResetRequest(
 		dbContext: DatabaseContext,
@@ -45,6 +45,7 @@ export class PasswordResetManager {
 				email: person.email,
 				token: result.token,
 				project: project?.name,
+				projectSlug: project?.slug,
 			},
 			{
 				variant: mailOptions.mailVariant || '',

package/src/model/service/SignUpManager.ts

@@ -6,6 +6,7 @@ import { getPasswordWeaknessMessage } from '../utils/password'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { DatabaseContext } from '../utils'
 import { MaybePassword } from '../dtos'
+import { validateEmail } from '../utils/email'
 
 type SignUpUser = {
 	email: string
@@ -16,6 +17,9 @@ type SignUpUser = {
 
 export class SignUpManager {
 	async signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {
+		if (!validateEmail(email.trim())) {
+			return new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')
+		}
 		if (await this.isEmailAlreadyUsed(dbContext, email)) {
 			return new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)
 		}

package/src/model/service/idp/providers/AppleProvider.ts

@@ -56,10 +56,16 @@ export class AppleProvider implements IdentityProviderHandler<AppleConfiguration
 			.setExpirationTime('10m')
 			.sign(privateKey)
 
-		return new this.issuer.Client({
-			client_id: configuration.clientId,
-			client_secret: jwt,
-			response_types: [configuration.responseType || 'code'],
-		})
+		return new this.issuer.Client(
+			{
+				client_id: configuration.clientId,
+				client_secret: jwt,
+				response_types: [configuration.responseType || 'code'],
+			},
+			undefined,
+			{
+				additionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],
+			},
+		)
 	}
 }

package/src/model/service/idp/providers/FacebookProvider.ts

@@ -116,10 +116,16 @@ export class FacebookProvider implements IdentityProviderHandler<FacebookConfigu
 	}
 
 	private async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {
-		return new this.facebookIssuer.Client({
-			client_id: configuration.clientId,
-			client_secret: configuration.clientSecret,
-			response_types: [configuration.responseType || 'code'],
-		})
+		return new this.facebookIssuer.Client(
+			{
+				client_id: configuration.clientId,
+				client_secret: configuration.clientSecret,
+				response_types: [configuration.responseType || 'code'],
+			},
+			undefined,
+			{
+				additionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],
+			},
+		)
 	}
 }

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -31,10 +31,16 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 	private async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {
 		this.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)
 
-		return new this.issuerCache[configuration.url].Client({
-			client_id: configuration.clientId,
-			client_secret: configuration.clientSecret,
-			response_types: [configuration.responseType || 'code'],
-		})
+		return new this.issuerCache[configuration.url].Client(
+			{
+				client_id: configuration.clientId,
+				client_secret: configuration.clientSecret,
+				response_types: [configuration.responseType || 'code'],
+			},
+			undefined,
+			{
+				additionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],
+			},
+		)
 	}
 }

package/src/model/service/idp/providers/OIDCTypes.ts

@@ -9,6 +9,7 @@ export interface OIDCSessionData {
 export const OIDCConfigurationOptions = Typesafe.partial({
 	responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
 	claims: Typesafe.string,
+	additionalAuthorizedParties: Typesafe.array(Typesafe.string),
 })
 export const BaseOIDCConfiguration = Typesafe.intersection(
 	Typesafe.object({

package/src/model/utils/email.ts

@@ -1,5 +1,9 @@
-import { Literal } from '@contember/database'
-
 export const normalizeEmail = (email: string) => {
 	return email.replaceAll(/\s/g, '').toLocaleLowerCase()
 }
+
+export const validateEmail = (email: string): boolean => {
+	return email.length >= 3
+		&& email.includes('@')
+		&& !!email.match(/^[^\s@]+@[\w_-]+(\.[\w_-]+)*$/)
+}

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -24,6 +24,9 @@ export class ProjectTypeResolver implements ProjectResolvers {
 		if (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {
 			throw new UserInputError(`Cannot use email filter for ApiKey member type.`)
 		}
+		if (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {
+			throw new UserInputError(`Cannot use personId  filter for ApiKey member type.`)
+		}
 		if (args.memberType && args.input) {
 			throw new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)
 		}

package/src/schema/index.ts

@@ -275,9 +275,9 @@ export type CreateSessionTokenError = {
 }
 
 export type CreateSessionTokenErrorCode =
+  | 'PERSON_DISABLED'
   | 'UNKNOWN_EMAIL'
   | 'UNKNOWN_PERSON_ID'
-  | 'PERSON_DISABLED'
 
 export type CreateSessionTokenResponse = {
 	readonly __typename?: 'CreateSessionTokenResponse'
@@ -352,7 +352,7 @@ export type DisablePersonError = {
 }
 
 export type DisablePersonErrorCode =
-  'PERSON_ALREADY_DISABLED'
+  | 'PERSON_ALREADY_DISABLED'
   | 'PERSON_NOT_FOUND'
 
 export type DisablePersonResponse = {
@@ -461,6 +461,7 @@ export type InviteError = {
 
 export type InviteErrorCode =
   | 'ALREADY_MEMBER'
+  | 'INVALID_EMAIL_FORMAT'
   | 'INVALID_MEMBERSHIP'
   | 'PROJECT_NOT_FOUND'
   | 'ROLE_NOT_FOUND'
@@ -852,8 +853,10 @@ export type ProjectIdentityRelation = {
 }
 
 export type ProjectMembersFilter = {
-	readonly email?: InputMaybe<Scalars['String']>
+	readonly email?: InputMaybe<ReadonlyArray<Scalars['String']>>
+	readonly identityId?: InputMaybe<ReadonlyArray<Scalars['String']>>
 	readonly memberType?: InputMaybe<MemberType>
+	readonly personId?: InputMaybe<ReadonlyArray<Scalars['String']>>
 }
 
 export type ProjectMembersInput = {
@@ -1031,8 +1034,8 @@ export type SignInErrorCode =
   | 'INVALID_PASSWORD'
   | 'NO_PASSWORD_SET'
   | 'OTP_REQUIRED'
-  | 'UNKNOWN_EMAIL'
   | 'PERSON_DISABLED'
+  | 'UNKNOWN_EMAIL'
 
 export type SignInIdpError = {
 	readonly __typename?: 'SignInIDPError'
@@ -1046,8 +1049,8 @@ export type SignInIdpErrorCode =
   | 'IDP_VALIDATION_FAILED'
   | 'INVALID_IDP_RESPONSE'
   | 'PERSON_ALREADY_EXISTS'
-  | 'PERSON_NOT_FOUND'
   | 'PERSON_DISABLED'
+  | 'PERSON_NOT_FOUND'
 
 export type SignInIdpResponse = {
 	readonly __typename?: 'SignInIDPResponse'
@@ -1109,6 +1112,7 @@ export type SignUpError = {
 
 export type SignUpErrorCode =
   | 'EMAIL_ALREADY_EXISTS'
+  | 'INVALID_EMAIL_FORMAT'
   | 'TOO_WEAK'
 
 export type SignUpResponse = {

package/src/schema/tenant.graphql.ts

@@ -116,6 +116,7 @@ const schema: DocumentNode = gql`
 
 	enum SignUpErrorCode {
 		EMAIL_ALREADY_EXISTS
+		INVALID_EMAIL_FORMAT
 		TOO_WEAK
 	}
 
@@ -393,6 +394,7 @@ const schema: DocumentNode = gql`
 		PROJECT_NOT_FOUND
 		ALREADY_MEMBER
 		INVALID_MEMBERSHIP
+		INVALID_EMAIL_FORMAT
 
 		ROLE_NOT_FOUND @deprecated
 		VARIABLE_NOT_FOUND @deprecated
@@ -684,7 +686,9 @@ const schema: DocumentNode = gql`
 
 	input ProjectMembersFilter {
 		memberType: MemberType
-		email: String
+		email: [String!]
+		identityId: [String!]
+		personId: [String!]
 	}
 
 	enum MemberType {

package/tests/cases/integration/mocked/listProjectMembersQuery.test.ts

@@ -0,0 +1,83 @@
+import { executeTenantTest } from '../../../src/testTenant'
+import { GQL } from '../../../src/tags'
+import { testUuid } from '../../../src/testUuid'
+import { test } from 'vitest'
+import { sqlTransaction } from './sql/sqlTransaction'
+
+test('list project members by email query', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {	
+	projectBySlug(slug: "sandbox") {
+		members(
+			input: { filter: { email: ["foo@localhost", "bar@localhost"], memberType: PERSON } }
+		) {
+			identity {
+				id
+			}
+			memberships {
+				role
+				variables {
+					name
+					values
+				}
+			}
+		}
+	}
+}`,
+			variables: {},
+		},
+		executes: [
+			{
+				sql: `SELECT "id", "name", "slug", "config", "updated_at" AS "updatedAt"
+                      FROM "tenant"."project"
+                      WHERE "slug" = ?`,
+				parameters: ['sandbox'],
+				response: { rows: [{ id: testUuid(1), name: 'sandbox', slug: 'sandbox', config: {}, updatedAt: new Date() }] },
+			},
+			...sqlTransaction(
+				{
+					sql: `select "id", "description"  from "tenant"."identity"  
+                            where exists (select ?::int  from "tenant"."project_membership"  
+                                                         where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?) 
+                              and exists (select ?::int  from "tenant"."person"  where "person"."identity_id" = "identity"."id" and "email" in (?, ?))`,
+					parameters: [1, testUuid(1), 1, 'foo@localhost', 'bar@localhost'],
+					response: {
+						rows: [
+							{ id: testUuid(2), description: 'foobar' },
+						],
+					},
+				},
+				{
+					sql: `with 
+    					"memberships" as (select "project_membership"."id", "project_membership"."role", "project_membership"."identity_id"  from "tenant"."project_membership"  where "identity_id" in (?) and "project_id" = ?), 
+    					"variables" as (select "membership_id", json_agg(json_build_object('name', variable, 'values', value)) as "variables"  from "tenant"."project_membership_variable" inner join  "memberships" on  "project_membership_variable"."membership_id" = "memberships"."id"   group by "membership_id") 
+						select "role", coalesce(variables, '[]'::json) as "variables", "identity_id" as "identityId"  from "memberships" left join  "variables" on  "memberships"."id" = "variables"."membership_id"`,
+					parameters: [testUuid(2), testUuid(1)],
+					response: {
+						rows: [
+							{
+								role: 'foo',
+								variables: [{ values: ['x', 'y'],  name: 'xyz' }],
+								identityId: testUuid(2),
+							},
+						],
+					},
+				},
+			),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					members: [
+						{
+							identity: { id: testUuid(2) },
+							memberships: [{ role: 'foo', variables: [{ name: 'xyz', values: ['x', 'y'] }] }],
+						},
+					],
+				},
+			},
+		},
+	})
+})

package/tests/cases/unit/authorization/membershipAwareAccessNode.test.ts

@@ -68,7 +68,7 @@ const aclSchemaForInviteOnly: Acl.Schema = {
 }
 
 
-test('admin can invite public. cannat manage public, cannot invite lorem', async () => {
+test('admin can invite public. cannot manage public, cannot invite lorem', async () => {
 	const node = new AclSchemaAccessNodeFactory().create(aclSchemaForInviteOnly, [{ role: 'admin', variables: [] }])
 
 	assert.ok(await node.isAllowed(aclEvaluator, PermissionActions.PERSON_INVITE([{ role: 'public', variables: [] }])))
@@ -77,3 +77,27 @@ test('admin can invite public. cannat manage public, cannot invite lorem', async
 
 	assert.notOk(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_REMOVE_MEMBER([{ role: 'public', variables: [] }])))
 })
+
+
+const aclSchemaForViewOnly: Acl.Schema = {
+	roles: {
+		admin: {
+			entities: {},
+			variables: {},
+			tenant: {
+				view: {
+					lorem: true,
+				},
+			},
+		},
+	},
+}
+
+
+test('admin can view lorem, but cannot manage it', async () => {
+	const node = new AclSchemaAccessNodeFactory().create(aclSchemaForViewOnly, [{ role: 'admin', variables: [] }])
+
+	assert.ok(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_VIEW_MEMBER([{ role: 'lorem', variables: [] }])))
+
+	assert.notOk(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_REMOVE_MEMBER([{ role: 'lorem', variables: [] }])))
+})