@contember/engine-tenant-api 1.3.0-rc.3 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "1.3.0-rc.3",
+  "version": "1.3.1",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -13,16 +13,16 @@
     "test": "vitest --dir ./tests/cases --no-threads"
   },
   "dependencies": {
-    "@contember/authorization": "1.3.0-rc.3",
-    "@contember/config-loader": "1.3.0-rc.3",
-    "@contember/database": "1.3.0-rc.3",
-    "@contember/database-migrations": "1.3.0-rc.3",
-    "@contember/dic": "1.3.0-rc.3",
-    "@contember/graphql-utils": "1.3.0-rc.3",
-    "@contember/logger": "1.3.0-rc.3",
-    "@contember/schema": "1.3.0-rc.3",
-    "@contember/schema-utils": "1.3.0-rc.3",
-    "@contember/typesafe": "1.3.0-rc.3",
+    "@contember/authorization": "1.3.1",
+    "@contember/config-loader": "1.3.1",
+    "@contember/database": "1.3.1",
+    "@contember/database-migrations": "1.3.1",
+    "@contember/dic": "1.3.1",
+    "@contember/graphql-utils": "1.3.1",
+    "@contember/logger": "1.3.1",
+    "@contember/schema": "1.3.1",
+    "@contember/schema-utils": "1.3.1",
+    "@contember/typesafe": "1.3.1",
     "@graphql-tools/utils": "^8.6.13",
     "graphql-tag": "^2.12.5",
     "jose": "^4.10",
@@ -32,7 +32,7 @@
     "otpauth": "^7.0.6"
   },
   "devDependencies": {
-    "@contember/database-tester": "1.3.0-rc.3",
+    "@contember/database-tester": "1.3.1",
     "@graphql-codegen/cli": "^2.6.2",
     "@graphql-codegen/typescript": "^2.5.1",
     "@graphql-codegen/typescript-operations": "^2.4.2",

package/src/model/authorization/AclSchemaAccessNodeFactory.ts

@@ -38,6 +38,12 @@ export class AclSchemaAccessNodeFactory {
 			node.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)
 			node.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)
 		}
+
+		if (membershipRoles.some(it => it.tenant?.view)) {
+			const verifier = createVerifier(it => it.view ?? {})
+			node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)
+		}
+
 		return node
 	}
 }

package/src/model/authorization/PermissionActions.ts

@@ -57,6 +57,7 @@ namespace PermissionActions {
 	export const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')
 	export const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')
 	export const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')
+	export const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')
 }
 
 export { PermissionActions }

package/src/model/authorization/PermissionsFactory.ts

@@ -57,6 +57,7 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)
 

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -23,22 +23,30 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 					.where({ project_id: this.projectId }),
 			))
 			.match(qb => {
-				const { email, memberType } = this.projectMemberInput.filter ?? {}
-				if (email && memberType === 'API_KEY') {
+				const identityId = this.projectMemberInput.filter?.identityId
+				return identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb
+			})
+			.match(qb => {
+				const { email, memberType, personId } = this.projectMemberInput.filter ?? {}
+				if ((email || personId) && memberType === 'API_KEY') {
 					throw new ImplementationException()
 				}
+
 				const personQuery = SelectBuilder.create()
 					.from('person')
 					.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))
-				if (email) {
-					return qb.where(it => it.exists(personQuery.where({ email })))
+					.match(qb => email ? qb.where(it => it.in('email', email)) : qb)
+					.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)
+
+
+				if (email || personId || memberType === 'PERSON') {
+					return qb.where(it => it.exists(personQuery))
 				}
-				switch (memberType) {
-					case 'API_KEY':
-						return qb.where(it => it.not(it => it.exists(personQuery)))
-					case 'PERSON':
-						return qb.where(it => it.exists(personQuery))
+
+				if (memberType === 'API_KEY') {
+					return qb.where(it => it.not(it => it.exists(personQuery)))
 				}
+
 				return qb
 			})
 			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)

package/src/model/service/InviteManager.ts

@@ -12,10 +12,11 @@ import { InviteErrorCode, InviteMethod } from '../../schema'
 import { TenantRole } from '../authorization'
 import { UserMailer } from '../mailing'
 import { createAppendMembershipVariables } from './membershipUtils'
-import { Response, ResponseOk } from '../utils/Response'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { DatabaseContext, TokenHash } from '../utils'
 import { NoPassword, PasswordPlain } from '../dtos'
 import { Acl } from '@contember/schema'
+import { validateEmail } from '../utils/email'
 
 export interface InviteData {
 	email: string
@@ -52,6 +53,10 @@ export class InviteManager {
 			passwordResetTokenHash,
 		}: InviteData,
 	): Promise<InviteResponse> {
+		if (!validateEmail(email.trim())) {
+			return new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')
+		}
+
 		return await dbContext.transaction(async trx => {
 			let person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))
 			const isNew = !person

package/src/model/service/SignUpManager.ts

@@ -6,6 +6,7 @@ import { getPasswordWeaknessMessage } from '../utils/password'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { DatabaseContext } from '../utils'
 import { MaybePassword } from '../dtos'
+import { validateEmail } from '../utils/email'
 
 type SignUpUser = {
 	email: string
@@ -16,6 +17,9 @@ type SignUpUser = {
 
 export class SignUpManager {
 	async signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {
+		if (!validateEmail(email.trim())) {
+			return new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')
+		}
 		if (await this.isEmailAlreadyUsed(dbContext, email)) {
 			return new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)
 		}

package/src/model/utils/email.ts

@@ -1,5 +1,9 @@
-import { Literal } from '@contember/database'
-
 export const normalizeEmail = (email: string) => {
 	return email.replaceAll(/\s/g, '').toLocaleLowerCase()
 }
+
+export const validateEmail = (email: string): boolean => {
+	return email.length >= 3
+		&& email.includes('@')
+		&& !!email.match(/^[^\s@]+@[\w_-]+(\.[\w_-]+)*$/)
+}

package/src/resolvers/query/IDPQueryResolver.ts

@@ -1,9 +1,14 @@
 import { IdentityProvider, QueryResolvers } from '../../schema'
-import { IdentityProvidersQuery } from '../../model'
+import { IdentityProvidersQuery, PermissionActions } from '../../model'
 import { TenantResolverContext } from '../TenantResolverContext'
 
 export class IDPQueryResolver implements QueryResolvers {
 	async identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {
+		await context.requireAccess({
+			action: PermissionActions.IDP_LIST,
+			message: 'You are not allowed to list IDP',
+		})
+
 		return await context.db.queryHandler.fetch(new IdentityProvidersQuery())
 	}
 }

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -24,6 +24,9 @@ export class ProjectTypeResolver implements ProjectResolvers {
 		if (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {
 			throw new UserInputError(`Cannot use email filter for ApiKey member type.`)
 		}
+		if (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {
+			throw new UserInputError(`Cannot use personId  filter for ApiKey member type.`)
+		}
 		if (args.memberType && args.input) {
 			throw new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)
 		}

package/src/schema/index.ts

@@ -275,9 +275,9 @@ export type CreateSessionTokenError = {
 }
 
 export type CreateSessionTokenErrorCode =
+  | 'PERSON_DISABLED'
   | 'UNKNOWN_EMAIL'
   | 'UNKNOWN_PERSON_ID'
-  | 'PERSON_DISABLED'
 
 export type CreateSessionTokenResponse = {
 	readonly __typename?: 'CreateSessionTokenResponse'
@@ -352,7 +352,7 @@ export type DisablePersonError = {
 }
 
 export type DisablePersonErrorCode =
-  'PERSON_ALREADY_DISABLED'
+  | 'PERSON_ALREADY_DISABLED'
   | 'PERSON_NOT_FOUND'
 
 export type DisablePersonResponse = {
@@ -461,6 +461,7 @@ export type InviteError = {
 
 export type InviteErrorCode =
   | 'ALREADY_MEMBER'
+  | 'INVALID_EMAIL_FORMAT'
   | 'INVALID_MEMBERSHIP'
   | 'PROJECT_NOT_FOUND'
   | 'ROLE_NOT_FOUND'
@@ -852,8 +853,10 @@ export type ProjectIdentityRelation = {
 }
 
 export type ProjectMembersFilter = {
-	readonly email?: InputMaybe<Scalars['String']>
+	readonly email?: InputMaybe<ReadonlyArray<Scalars['String']>>
+	readonly identityId?: InputMaybe<ReadonlyArray<Scalars['String']>>
 	readonly memberType?: InputMaybe<MemberType>
+	readonly personId?: InputMaybe<ReadonlyArray<Scalars['String']>>
 }
 
 export type ProjectMembersInput = {
@@ -1031,8 +1034,8 @@ export type SignInErrorCode =
   | 'INVALID_PASSWORD'
   | 'NO_PASSWORD_SET'
   | 'OTP_REQUIRED'
-  | 'UNKNOWN_EMAIL'
   | 'PERSON_DISABLED'
+  | 'UNKNOWN_EMAIL'
 
 export type SignInIdpError = {
 	readonly __typename?: 'SignInIDPError'
@@ -1046,8 +1049,8 @@ export type SignInIdpErrorCode =
   | 'IDP_VALIDATION_FAILED'
   | 'INVALID_IDP_RESPONSE'
   | 'PERSON_ALREADY_EXISTS'
-  | 'PERSON_NOT_FOUND'
   | 'PERSON_DISABLED'
+  | 'PERSON_NOT_FOUND'
 
 export type SignInIdpResponse = {
 	readonly __typename?: 'SignInIDPResponse'
@@ -1109,6 +1112,7 @@ export type SignUpError = {
 
 export type SignUpErrorCode =
   | 'EMAIL_ALREADY_EXISTS'
+  | 'INVALID_EMAIL_FORMAT'
   | 'TOO_WEAK'
 
 export type SignUpResponse = {

package/src/schema/tenant.graphql.ts

@@ -116,6 +116,7 @@ const schema: DocumentNode = gql`
 
 	enum SignUpErrorCode {
 		EMAIL_ALREADY_EXISTS
+		INVALID_EMAIL_FORMAT
 		TOO_WEAK
 	}
 
@@ -393,6 +394,7 @@ const schema: DocumentNode = gql`
 		PROJECT_NOT_FOUND
 		ALREADY_MEMBER
 		INVALID_MEMBERSHIP
+		INVALID_EMAIL_FORMAT
 
 		ROLE_NOT_FOUND @deprecated
 		VARIABLE_NOT_FOUND @deprecated
@@ -684,7 +686,9 @@ const schema: DocumentNode = gql`
 
 	input ProjectMembersFilter {
 		memberType: MemberType
-		email: String
+		email: [String!]
+		identityId: [String!]
+		personId: [String!]
 	}
 
 	enum MemberType {

package/tests/cases/integration/mocked/listProjectMembersQuery.test.ts

@@ -0,0 +1,83 @@
+import { executeTenantTest } from '../../../src/testTenant'
+import { GQL } from '../../../src/tags'
+import { testUuid } from '../../../src/testUuid'
+import { test } from 'vitest'
+import { sqlTransaction } from './sql/sqlTransaction'
+
+test('list project members by email query', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {	
+	projectBySlug(slug: "sandbox") {
+		members(
+			input: { filter: { email: ["foo@localhost", "bar@localhost"], memberType: PERSON } }
+		) {
+			identity {
+				id
+			}
+			memberships {
+				role
+				variables {
+					name
+					values
+				}
+			}
+		}
+	}
+}`,
+			variables: {},
+		},
+		executes: [
+			{
+				sql: `SELECT "id", "name", "slug", "config", "updated_at" AS "updatedAt"
+                      FROM "tenant"."project"
+                      WHERE "slug" = ?`,
+				parameters: ['sandbox'],
+				response: { rows: [{ id: testUuid(1), name: 'sandbox', slug: 'sandbox', config: {}, updatedAt: new Date() }] },
+			},
+			...sqlTransaction(
+				{
+					sql: `select "id", "description"  from "tenant"."identity"  
+                            where exists (select ?::int  from "tenant"."project_membership"  
+                                                         where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?) 
+                              and exists (select ?::int  from "tenant"."person"  where "person"."identity_id" = "identity"."id" and "email" in (?, ?))`,
+					parameters: [1, testUuid(1), 1, 'foo@localhost', 'bar@localhost'],
+					response: {
+						rows: [
+							{ id: testUuid(2), description: 'foobar' },
+						],
+					},
+				},
+				{
+					sql: `with 
+    					"memberships" as (select "project_membership"."id", "project_membership"."role", "project_membership"."identity_id"  from "tenant"."project_membership"  where "identity_id" in (?) and "project_id" = ?), 
+    					"variables" as (select "membership_id", json_agg(json_build_object('name', variable, 'values', value)) as "variables"  from "tenant"."project_membership_variable" inner join  "memberships" on  "project_membership_variable"."membership_id" = "memberships"."id"   group by "membership_id") 
+						select "role", coalesce(variables, '[]'::json) as "variables", "identity_id" as "identityId"  from "memberships" left join  "variables" on  "memberships"."id" = "variables"."membership_id"`,
+					parameters: [testUuid(2), testUuid(1)],
+					response: {
+						rows: [
+							{
+								role: 'foo',
+								variables: [{ values: ['x', 'y'],  name: 'xyz' }],
+								identityId: testUuid(2),
+							},
+						],
+					},
+				},
+			),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					members: [
+						{
+							identity: { id: testUuid(2) },
+							memberships: [{ role: 'foo', variables: [{ name: 'xyz', values: ['x', 'y'] }] }],
+						},
+					],
+				},
+			},
+		},
+	})
+})

package/tests/cases/unit/authorization/membershipAwareAccessNode.test.ts

@@ -68,7 +68,7 @@ const aclSchemaForInviteOnly: Acl.Schema = {
 }
 
 
-test('admin can invite public. cannat manage public, cannot invite lorem', async () => {
+test('admin can invite public. cannot manage public, cannot invite lorem', async () => {
 	const node = new AclSchemaAccessNodeFactory().create(aclSchemaForInviteOnly, [{ role: 'admin', variables: [] }])
 
 	assert.ok(await node.isAllowed(aclEvaluator, PermissionActions.PERSON_INVITE([{ role: 'public', variables: [] }])))
@@ -77,3 +77,27 @@ test('admin can invite public. cannat manage public, cannot invite lorem', async
 
 	assert.notOk(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_REMOVE_MEMBER([{ role: 'public', variables: [] }])))
 })
+
+
+const aclSchemaForViewOnly: Acl.Schema = {
+	roles: {
+		admin: {
+			entities: {},
+			variables: {},
+			tenant: {
+				view: {
+					lorem: true,
+				},
+			},
+		},
+	},
+}
+
+
+test('admin can view lorem, but cannot manage it', async () => {
+	const node = new AclSchemaAccessNodeFactory().create(aclSchemaForViewOnly, [{ role: 'admin', variables: [] }])
+
+	assert.ok(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_VIEW_MEMBER([{ role: 'lorem', variables: [] }])))
+
+	assert.notOk(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_REMOVE_MEMBER([{ role: 'lorem', variables: [] }])))
+})