@contember/engine-tenant-api 1.4.0-rc.8 → 2.0.0-alpha.8

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.cjs

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+const ProjectsQuery = require("./ProjectsQuery.cjs");
+const PermissionActions = require("../../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../authorization/PermissionContext.cjs");
+require("../../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+class ProjectsByIdentityQuery extends Database.DatabaseQuery {
+  constructor(identityId, permissionContext) {
+    super();
+    this.identityId = identityId;
+    this.permissionContext = permissionContext;
+  }
+  async fetch(queryable) {
+    const canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({
+      action: PermissionActions.PermissionActions.PROJECT_VIEW
+    });
+    if (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {
+      return await new ProjectsQuery.ProjectsQuery().fetch(queryable);
+    }
+    const qb = Database.SelectBuilder.create().select(["project", "id"]).select(["project", "name"]).select(["project", "slug"]).select(["project", "config"]).from("project").where(
+      (where) => where.in(
+        ["project", "id"],
+        Database.SelectBuilder.create().from("project_membership").select("project_id").where({
+          identity_id: this.identityId
+        })
+      )
+    );
+    const qbWithIdentityPermissions = canAuthorizedEntityViewAll ? qb : qb.where(
+      (where) => where.in(
+        ["project", "id"],
+        Database.SelectBuilder.create().from("project_membership").select("project_id").where({
+          identity_id: this.permissionContext.identity.id
+        })
+      )
+    );
+    return await qbWithIdentityPermissions.getResult(queryable.db);
+  }
+}
+exports.ProjectsByIdentityQuery = ProjectsByIdentityQuery;
+//# sourceMappingURL=ProjectsByIdentityQuery.cjs.map

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectsByIdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery'\nimport { PermissionActions, PermissionContext } from '../../authorization'\nimport { Project } from '../../type'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t  )\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":["DatabaseQuery","PermissionActions","ProjectsQuery","SelectBuilder"],"mappings":";;;;;;;;;AAKO,MAAM,gCAAgCA,SAAAA,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACjG;AADsB,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQC,kBAAkB,kBAAA;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAIC,cAAc,cAAA,EAAE,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAgB,EACvC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,OACZ,EAAA,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MACH;AAAA,IAAA;AAGI,UAAA,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,OAAS,EAAA,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MACF;AAAA,IAAA;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;;"}

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.js

@@ -0,0 +1,43 @@
+import { DatabaseQuery, SelectBuilder } from "@contember/database";
+import { ProjectsQuery } from "./ProjectsQuery.js";
+import { PermissionActions } from "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/PermissionsFactory.js";
+import "@contember/schema";
+class ProjectsByIdentityQuery extends DatabaseQuery {
+  constructor(identityId, permissionContext) {
+    super();
+    this.identityId = identityId;
+    this.permissionContext = permissionContext;
+  }
+  async fetch(queryable) {
+    const canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({
+      action: PermissionActions.PROJECT_VIEW
+    });
+    if (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {
+      return await new ProjectsQuery().fetch(queryable);
+    }
+    const qb = SelectBuilder.create().select(["project", "id"]).select(["project", "name"]).select(["project", "slug"]).select(["project", "config"]).from("project").where(
+      (where) => where.in(
+        ["project", "id"],
+        SelectBuilder.create().from("project_membership").select("project_id").where({
+          identity_id: this.identityId
+        })
+      )
+    );
+    const qbWithIdentityPermissions = canAuthorizedEntityViewAll ? qb : qb.where(
+      (where) => where.in(
+        ["project", "id"],
+        SelectBuilder.create().from("project_membership").select("project_id").where({
+          identity_id: this.permissionContext.identity.id
+        })
+      )
+    );
+    return await qbWithIdentityPermissions.getResult(queryable.db);
+  }
+}
+export {
+  ProjectsByIdentityQuery
+};
+//# sourceMappingURL=ProjectsByIdentityQuery.js.map

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectsByIdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery'\nimport { PermissionActions, PermissionContext } from '../../authorization'\nimport { Project } from '../../type'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t  )\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;AAKO,MAAM,gCAAgC,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACjG;AADsB,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAI,cAAc,EAAE,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAK,cAAc,OAAgB,EACvC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,OACZ,EAAA,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MACH;AAAA,IAAA;AAGI,UAAA,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,OAAS,EAAA,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MACF;AAAA,IAAA;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;"}

package/dist/development/src/model/queries/project/ProjectsQuery.cjs

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class ProjectsQuery extends Database.DatabaseQuery {
+  async fetch({ db }) {
+    return await Database.SelectBuilder.create().select("id").select("name").select("slug").select("config").from("project").orderBy("slug").getResult(db);
+  }
+}
+exports.ProjectsQuery = ProjectsQuery;
+//# sourceMappingURL=ProjectsQuery.cjs.map

package/dist/development/src/model/queries/project/ProjectsQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectsQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { Project } from '../../type'\n\nexport class ProjectsQuery extends DatabaseQuery<Project[]> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Project[]> {\n\t\treturn await SelectBuilder.create<Project>()\n\t\t\t.select('id')\n\t\t\t.select('name')\n\t\t\t.select('slug')\n\t\t\t.select('config')\n\t\t\t.from('project')\n\t\t\t.orderBy('slug')\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAGO,MAAM,sBAAsBA,SAAAA,cAAyB;AAAA,EAC3D,MAAM,MAAM,EAAE,MAA6C;AACnD,WAAA,MAAMC,SAAAA,cAAc,OAAgB,EACzC,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,QAAQ,EACf,KAAK,SAAS,EACd,QAAQ,MAAM,EACd,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/development/src/model/queries/project/ProjectsQuery.js

@@ -0,0 +1,10 @@
+import { DatabaseQuery, SelectBuilder } from "@contember/database";
+class ProjectsQuery extends DatabaseQuery {
+  async fetch({ db }) {
+    return await SelectBuilder.create().select("id").select("name").select("slug").select("config").from("project").orderBy("slug").getResult(db);
+  }
+}
+export {
+  ProjectsQuery
+};
+//# sourceMappingURL=ProjectsQuery.js.map

package/dist/development/src/model/queries/project/ProjectsQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectsQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { Project } from '../../type'\n\nexport class ProjectsQuery extends DatabaseQuery<Project[]> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Project[]> {\n\t\treturn await SelectBuilder.create<Project>()\n\t\t\t.select('id')\n\t\t\t.select('name')\n\t\t\t.select('slug')\n\t\t\t.select('config')\n\t\t\t.from('project')\n\t\t\t.orderBy('slug')\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,sBAAsB,cAAyB;AAAA,EAC3D,MAAM,MAAM,EAAE,MAA6C;AACnD,WAAA,MAAM,cAAc,OAAgB,EACzC,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,QAAQ,EACf,KAAK,SAAS,EACd,QAAQ,MAAM,EACd,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/development/src/model/service/EmailValidator.cjs

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const email = require("../utils/email.cjs");
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+class EmailValidator {
+  async validateEmail(db, email$1) {
+    if (!email.validateEmail(email$1.trim())) {
+      return new Response.ResponseError("INVALID_EMAIL_FORMAT", "E-mail address is not in a valid format");
+    }
+    if (await this.isEmailAlreadyUsed(db, email$1)) {
+      return new Response.ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${email$1} already exists`);
+    }
+    return null;
+  }
+  async isEmailAlreadyUsed(db, email2) {
+    const personOrNull = await db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email2));
+    return personOrNull !== null;
+  }
+}
+exports.EmailValidator = EmailValidator;
+//# sourceMappingURL=EmailValidator.cjs.map

package/dist/development/src/model/service/EmailValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { validateEmail } from '../utils/email'\nimport { ResponseError } from '../utils/Response'\nimport { PersonQuery } from '../queries'\n\nexport class EmailValidator {\n\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.isEmailAlreadyUsed(db, email)) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate async isEmailAlreadyUsed(db: DatabaseContext, email: string): Promise<boolean> {\n\t\tconst personOrNull = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\treturn personOrNull !== null\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":["email","validateEmail","ResponseError","PersonQuery"],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAE3B,MAAa,cAAc,IAAqBA,SAAmE;AAClH,QAAI,CAACC,MAAA,cAAcD,QAAM,KAAM,CAAA,GAAG;AAC1B,aAAA,IAAIE,SAAc,cAAA,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAIF,OAAK,GAAG;AAC7C,aAAO,IAAIE,SAAA,cAAc,wBAAwB,mBAAmBF,OAAK,iBAAiB;AAAA,IAC3F;AACO,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,mBAAmB,IAAqBA,QAAiC;AAChF,UAAA,eAAe,MAAM,GAAG,aAAa,MAAMG,wBAAY,QAAQH,MAAK,CAAC;AAC3E,WAAO,iBAAiB;AAAA,EACzB;AACD;;"}

package/dist/development/src/model/service/EmailValidator.js

@@ -0,0 +1,29 @@
+import { validateEmail } from "../utils/email.js";
+import { ResponseError } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+class EmailValidator {
+  async validateEmail(db, email) {
+    if (!validateEmail(email.trim())) {
+      return new ResponseError("INVALID_EMAIL_FORMAT", "E-mail address is not in a valid format");
+    }
+    if (await this.isEmailAlreadyUsed(db, email)) {
+      return new ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${email} already exists`);
+    }
+    return null;
+  }
+  async isEmailAlreadyUsed(db, email) {
+    const personOrNull = await db.queryHandler.fetch(PersonQuery.byEmail(email));
+    return personOrNull !== null;
+  }
+}
+export {
+  EmailValidator
+};
+//# sourceMappingURL=EmailValidator.js.map

package/dist/development/src/model/service/EmailValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { validateEmail } from '../utils/email'\nimport { ResponseError } from '../utils/Response'\nimport { PersonQuery } from '../queries'\n\nexport class EmailValidator {\n\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.isEmailAlreadyUsed(db, email)) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate async isEmailAlreadyUsed(db: DatabaseContext, email: string): Promise<boolean> {\n\t\tconst personOrNull = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\treturn personOrNull !== null\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":[],"mappings":";;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAE3B,MAAa,cAAc,IAAqB,OAAmE;AAClH,QAAI,CAAC,cAAc,MAAM,KAAM,CAAA,GAAG;AAC1B,aAAA,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAI,KAAK,GAAG;AAC7C,aAAO,IAAI,cAAc,wBAAwB,mBAAmB,KAAK,iBAAiB;AAAA,IAC3F;AACO,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,mBAAmB,IAAqB,OAAiC;AAChF,UAAA,eAAe,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAC3E,WAAO,iBAAiB;AAAA,EACzB;AACD;"}

package/dist/development/src/model/service/IDPSignInManager.cjs

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const PersonByIdPQuery = require("../queries/person/PersonByIdPQuery.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+const IdentityProviderBySlugQuery = require("../queries/idp/IdentityProviderBySlugQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("../authorization/Roles.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const Response = require("../utils/Response.cjs");
+const IDPResponseError = require("./idp/IDPResponseError.cjs");
+const IDPValidationError = require("./idp/IDPValidationError.cjs");
+require("./idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("./idp/providers/OIDCTypes.cjs");
+require("./idp/providers/OIDCHelpers.cjs");
+require("./idp/providers/FacebookProvider.cjs");
+require("../type/ApiKey.cjs");
+require("node:crypto");
+const CreatePersonCommand = require("../commands/person/CreatePersonCommand.cjs");
+const CreatePersonIdentityProviderIdentifierCommand = require("../commands/person/CreatePersonIdentityProviderIdentifierCommand.cjs");
+const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
+const Password = require("../dtos/Password.cjs");
+class IDPSignInManager {
+  constructor(apiKeyManager, idpRegistry) {
+    this.apiKeyManager = apiKeyManager;
+    this.idpRegistry = idpRegistry;
+  }
+  async signInIDP(dbContext, idpSlug, responseData, expiration) {
+    return dbContext.transaction(async (db) => {
+      const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(idpSlug));
+      if (!provider || provider.disabledAt) {
+        throw new Error("provider not found");
+      }
+      const providerService = this.idpRegistry.getHandler(provider.type);
+      const validatedConfig = providerService.validateConfiguration(provider.configuration);
+      let claim;
+      try {
+        claim = await providerService.processResponse(
+          validatedConfig,
+          responseData
+        );
+      } catch (e) {
+        if (e instanceof IDPResponseError.IDPResponseError) {
+          return new Response.ResponseError("INVALID_IDP_RESPONSE", e.message);
+        }
+        if (e instanceof IDPValidationError.IDPValidationError) {
+          return new Response.ResponseError("IDP_VALIDATION_FAILED", e.message);
+        }
+        throw e;
+      }
+      const personRow = await this.resolvePerson(db, claim, provider);
+      if (!personRow) {
+        return new Response.ResponseError("PERSON_NOT_FOUND", `Person ${claim.email} not found`);
+      }
+      if (personRow.disabled_at !== null) {
+        return new Response.ResponseError("PERSON_DISABLED", `Person with e-mail ${claim.email} is disabled`);
+      }
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration);
+      return new Response.ResponseOk({ person: personRow, token: sessionToken });
+    });
+  }
+  async initSignInIDP(dbContext, idpSlug, data) {
+    const provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(idpSlug));
+    if (!provider || provider.disabledAt) {
+      return new Response.ResponseError("PROVIDER_NOT_FOUND", `Identity provider ${idpSlug} not found`);
+    }
+    const providerService = this.idpRegistry.getHandler(provider.type);
+    const validatedConfig = providerService.validateConfiguration(provider.configuration);
+    try {
+      const initResponse = await providerService.initAuth(validatedConfig, data);
+      const publicConfig = providerService.getPublicConfiguration ? providerService.getPublicConfiguration(validatedConfig) : validatedConfig;
+      return new Response.ResponseOk({
+        ...initResponse,
+        idpConfiguration: provider.initReturnsConfig ? publicConfig : null
+      });
+    } catch (e) {
+      if (e instanceof IDPValidationError.IDPValidationError) {
+        return new Response.ResponseError("IDP_VALIDATION_FAILED", e.message);
+      }
+      throw e;
+    }
+  }
+  async resolvePerson(db, claim, provider) {
+    const personByIdPQuery = new PersonByIdPQuery.PersonByIdPQuery(provider.id, claim.externalIdentifier);
+    const personByIdp = await db.queryHandler.fetch(personByIdPQuery);
+    if (personByIdp) {
+      return personByIdp;
+    }
+    if (!provider.exclusive) {
+      const personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(claim.email)) : null;
+      if (personByEmail) {
+        await this.saveIdpIdentifier(db, provider, claim, personByEmail);
+        return personByEmail;
+      }
+    }
+    if (provider.autoSignUp) {
+      const signedUpPerson = await this.signUp(db, claim, provider);
+      await this.saveIdpIdentifier(db, provider, claim, signedUpPerson);
+      return signedUpPerson;
+    }
+    return null;
+  }
+  async signUp(db, { email, name, externalIdentifier }, provider) {
+    const roles = [Roles.TenantRole.PERSON];
+    const identityId = await db.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand(roles));
+    const newPerson = await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({
+      identityId,
+      email: provider.exclusive ? void 0 : email,
+      password: Password.NoPassword,
+      name: name ?? email?.split("@")[0] ?? externalIdentifier,
+      idpOnly: provider.exclusive
+    }));
+    return {
+      ...newPerson,
+      roles
+    };
+  }
+  async saveIdpIdentifier(db, provider, claim, person) {
+    await db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand.CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier));
+  }
+}
+exports.IDPSignInManager = IDPSignInManager;
+//# sourceMappingURL=IDPSignInManager.cjs.map

package/dist/development/src/model/service/IDPSignInManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'\nimport { IDPClaim, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'\nimport { DatabaseContext } from '../utils'\nimport { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands'\nimport { TenantRole } from '../authorization'\nimport { NoPassword } from '../dtos'\nimport { IdentityProviderRow } from '../queries/idp/types'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPClaim\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message)\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst personRow = await this.resolvePerson(db, claim, provider)\n\n\t\t\tif (!personRow) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`)\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`)\n\t\t\t}\n\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\t\t\treturn new ResponseOk({ person: personRow, token: sessionToken })\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow | null> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn personByIdp\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email)) : null\n\t\t\tif (personByEmail) {\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn personByEmail\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn signedUpPerson\n\t\t}\n\n\t\treturn null\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(new CreatePersonCommand({\n\t\t\tidentityId,\n\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\tpassword: NoPassword,\n\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\tidpOnly: provider.exclusive,\n\t\t}))\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPClaim, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>\n}\n\nexport { IDPSignInManager }\n"],"names":["IdentityProviderBySlugQuery","IDPResponseError","ResponseError","IDPValidationError","ResponseOk","PersonByIdPQuery","PersonQuery","TenantRole","CreateIdentityCommand","CreatePersonCommand","NoPassword","CreatePersonIdentityProviderIdentifierCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,UACL,WACA,SACA,cACA,YAC8C;AACvC,WAAA,UAAU,YAAY,OAAO,OAAoD;AACjF,YAAA,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAA,4BAA4B,OAAO,CAAC;AACjF,UAAA,CAAC,YAAY,SAAS,YAAY;AAC/B,cAAA,IAAI,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,UAAA;AACA,UAAA;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAAA,eAEO,GAAG;AACX,YAAI,aAAaC,iBAAAA,kBAAkB;AAClC,iBAAO,IAAIC,SAAAA,cAAc,wBAAwB,EAAE,OAAO;AAAA,QAC3D;AACA,YAAI,aAAaC,mBAAAA,oBAAoB;AACpC,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,EAAE,OAAO;AAAA,QAC5D;AACM,cAAA;AAAA,MACP;AACA,YAAM,YAAY,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAE9D,UAAI,CAAC,WAAW;AACf,eAAO,IAAIA,SAAAA,cAAc,oBAAoB,UAAU,MAAM,KAAK,YAAY;AAAA,MAC/E;AAEI,UAAA,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,cAAc;AAAA,MAC5F;AAEM,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,IAAI,UAAU,aAAa,UAAU;AACvG,aAAO,IAAIE,SAAW,WAAA,EAAE,QAAQ,WAAW,OAAO,cAAc;AAAA,IAAA,CAChE;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAC1H,UAAA,WAAW,MAAM,UAAU,aAAa,MAAM,IAAIJ,4BAAA,4BAA4B,OAAO,CAAC;AACxF,QAAA,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAIE,SAAA,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IACxF;AACA,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,QAAA;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAIE,SAAAA,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,aACO,GAAG;AACX,UAAI,aAAaD,mBAAAA,oBAAoB;AACpC,eAAO,IAAID,SAAAA,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAC5D;AACM,YAAA;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,cAAc,IAAqB,OAAiB,UAA0D;AAC3H,UAAM,mBAAmB,IAAIG,kCAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AACT,aAAA;AAAA,IACR;AAEI,QAAA,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,MAAM,QAAQ,MAAM,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,MAAM,KAAK,CAAC,IAAI;AACpG,UAAI,eAAe;AAClB,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AACxD,eAAA;AAAA,MACR;AAAA,IACD;AAEA,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AACzD,aAAA;AAAA,IACR;AAEO,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,sBAAgC,UAAmD;AACrI,UAAA,QAAQ,CAACC,iBAAW,MAAM;AAC1B,UAAA,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,sBAAA,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW,QAAQ,IAAIC,oBAAAA,oBAAoB;AAAA,MACrE;AAAA,MACA,OAAO,SAAS,YAAY,SAAY;AAAA,MACxC,UAAUC,SAAA;AAAA,MACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,MACtC,SAAS,SAAS;AAAA,IAClB,CAAA,CAAC;AAEK,WAAA;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAc,kBAAkB,IAAqB,UAA+B,OAAiB,QAAmB;AACjH,UAAA,GAAG,WAAW,QAAQ,IAAIC,8CAAAA,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAChI;AACD;;"}

package/dist/development/src/model/service/IDPSignInManager.js

@@ -0,0 +1,129 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { PersonByIdPQuery } from "../queries/person/PersonByIdPQuery.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import { IdentityProviderBySlugQuery } from "../queries/idp/IdentityProviderBySlugQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import { TenantRole } from "../authorization/Roles.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { IDPResponseError } from "./idp/IDPResponseError.js";
+import { IDPValidationError } from "./idp/IDPValidationError.js";
+import "./idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "./idp/providers/OIDCTypes.js";
+import "./idp/providers/OIDCHelpers.js";
+import "./idp/providers/FacebookProvider.js";
+import "../type/ApiKey.js";
+import "node:crypto";
+import { CreatePersonCommand } from "../commands/person/CreatePersonCommand.js";
+import { CreatePersonIdentityProviderIdentifierCommand } from "../commands/person/CreatePersonIdentityProviderIdentifierCommand.js";
+import { CreateIdentityCommand } from "../commands/identity/CreateIdentityCommand.js";
+import { NoPassword } from "../dtos/Password.js";
+class IDPSignInManager {
+  constructor(apiKeyManager, idpRegistry) {
+    this.apiKeyManager = apiKeyManager;
+    this.idpRegistry = idpRegistry;
+  }
+  async signInIDP(dbContext, idpSlug, responseData, expiration) {
+    return dbContext.transaction(async (db) => {
+      const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug));
+      if (!provider || provider.disabledAt) {
+        throw new Error("provider not found");
+      }
+      const providerService = this.idpRegistry.getHandler(provider.type);
+      const validatedConfig = providerService.validateConfiguration(provider.configuration);
+      let claim;
+      try {
+        claim = await providerService.processResponse(
+          validatedConfig,
+          responseData
+        );
+      } catch (e) {
+        if (e instanceof IDPResponseError) {
+          return new ResponseError("INVALID_IDP_RESPONSE", e.message);
+        }
+        if (e instanceof IDPValidationError) {
+          return new ResponseError("IDP_VALIDATION_FAILED", e.message);
+        }
+        throw e;
+      }
+      const personRow = await this.resolvePerson(db, claim, provider);
+      if (!personRow) {
+        return new ResponseError("PERSON_NOT_FOUND", `Person ${claim.email} not found`);
+      }
+      if (personRow.disabled_at !== null) {
+        return new ResponseError("PERSON_DISABLED", `Person with e-mail ${claim.email} is disabled`);
+      }
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration);
+      return new ResponseOk({ person: personRow, token: sessionToken });
+    });
+  }
+  async initSignInIDP(dbContext, idpSlug, data) {
+    const provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug));
+    if (!provider || provider.disabledAt) {
+      return new ResponseError("PROVIDER_NOT_FOUND", `Identity provider ${idpSlug} not found`);
+    }
+    const providerService = this.idpRegistry.getHandler(provider.type);
+    const validatedConfig = providerService.validateConfiguration(provider.configuration);
+    try {
+      const initResponse = await providerService.initAuth(validatedConfig, data);
+      const publicConfig = providerService.getPublicConfiguration ? providerService.getPublicConfiguration(validatedConfig) : validatedConfig;
+      return new ResponseOk({
+        ...initResponse,
+        idpConfiguration: provider.initReturnsConfig ? publicConfig : null
+      });
+    } catch (e) {
+      if (e instanceof IDPValidationError) {
+        return new ResponseError("IDP_VALIDATION_FAILED", e.message);
+      }
+      throw e;
+    }
+  }
+  async resolvePerson(db, claim, provider) {
+    const personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier);
+    const personByIdp = await db.queryHandler.fetch(personByIdPQuery);
+    if (personByIdp) {
+      return personByIdp;
+    }
+    if (!provider.exclusive) {
+      const personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email)) : null;
+      if (personByEmail) {
+        await this.saveIdpIdentifier(db, provider, claim, personByEmail);
+        return personByEmail;
+      }
+    }
+    if (provider.autoSignUp) {
+      const signedUpPerson = await this.signUp(db, claim, provider);
+      await this.saveIdpIdentifier(db, provider, claim, signedUpPerson);
+      return signedUpPerson;
+    }
+    return null;
+  }
+  async signUp(db, { email, name, externalIdentifier }, provider) {
+    const roles = [TenantRole.PERSON];
+    const identityId = await db.commandBus.execute(new CreateIdentityCommand(roles));
+    const newPerson = await db.commandBus.execute(new CreatePersonCommand({
+      identityId,
+      email: provider.exclusive ? void 0 : email,
+      password: NoPassword,
+      name: name ?? email?.split("@")[0] ?? externalIdentifier,
+      idpOnly: provider.exclusive
+    }));
+    return {
+      ...newPerson,
+      roles
+    };
+  }
+  async saveIdpIdentifier(db, provider, claim, person) {
+    await db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier));
+  }
+}
+export {
+  IDPSignInManager
+};
+//# sourceMappingURL=IDPSignInManager.js.map

package/dist/development/src/model/service/IDPSignInManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'\nimport { IDPClaim, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'\nimport { DatabaseContext } from '../utils'\nimport { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands'\nimport { TenantRole } from '../authorization'\nimport { NoPassword } from '../dtos'\nimport { IdentityProviderRow } from '../queries/idp/types'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPClaim\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message)\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst personRow = await this.resolvePerson(db, claim, provider)\n\n\t\t\tif (!personRow) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`)\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`)\n\t\t\t}\n\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\t\t\treturn new ResponseOk({ person: personRow, token: sessionToken })\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow | null> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn personByIdp\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email)) : null\n\t\t\tif (personByEmail) {\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn personByEmail\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn signedUpPerson\n\t\t}\n\n\t\treturn null\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(new CreatePersonCommand({\n\t\t\tidentityId,\n\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\tpassword: NoPassword,\n\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\tidpOnly: provider.exclusive,\n\t\t}))\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPClaim, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>\n}\n\nexport { IDPSignInManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,UACL,WACA,SACA,cACA,YAC8C;AACvC,WAAA,UAAU,YAAY,OAAO,OAAoD;AACjF,YAAA,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,4BAA4B,OAAO,CAAC;AACjF,UAAA,CAAC,YAAY,SAAS,YAAY;AAC/B,cAAA,IAAI,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,UAAA;AACA,UAAA;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAAA,eAEO,GAAG;AACX,YAAI,aAAa,kBAAkB;AAClC,iBAAO,IAAI,cAAc,wBAAwB,EAAE,OAAO;AAAA,QAC3D;AACA,YAAI,aAAa,oBAAoB;AACpC,iBAAO,IAAI,cAAc,yBAAyB,EAAE,OAAO;AAAA,QAC5D;AACM,cAAA;AAAA,MACP;AACA,YAAM,YAAY,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAE9D,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,oBAAoB,UAAU,MAAM,KAAK,YAAY;AAAA,MAC/E;AAEI,UAAA,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAI,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,cAAc;AAAA,MAC5F;AAEM,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,IAAI,UAAU,aAAa,UAAU;AACvG,aAAO,IAAI,WAAW,EAAE,QAAQ,WAAW,OAAO,cAAc;AAAA,IAAA,CAChE;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAC1H,UAAA,WAAW,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,OAAO,CAAC;AACxF,QAAA,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAI,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IACxF;AACA,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,QAAA;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAI,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,aACO,GAAG;AACX,UAAI,aAAa,oBAAoB;AACpC,eAAO,IAAI,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAC5D;AACM,YAAA;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,cAAc,IAAqB,OAAiB,UAA0D;AAC3H,UAAM,mBAAmB,IAAI,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AACT,aAAA;AAAA,IACR;AAEI,QAAA,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,MAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,MAAM,KAAK,CAAC,IAAI;AACpG,UAAI,eAAe;AAClB,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AACxD,eAAA;AAAA,MACR;AAAA,IACD;AAEA,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AACzD,aAAA;AAAA,IACR;AAEO,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,sBAAgC,UAAmD;AACrI,UAAA,QAAQ,CAAC,WAAW,MAAM;AAC1B,UAAA,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB;AAAA,MACrE;AAAA,MACA,OAAO,SAAS,YAAY,SAAY;AAAA,MACxC,UAAU;AAAA,MACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,MACtC,SAAS,SAAS;AAAA,IAClB,CAAA,CAAC;AAEK,WAAA;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAc,kBAAkB,IAAqB,UAA+B,OAAiB,QAAmB;AACjH,UAAA,GAAG,WAAW,QAAQ,IAAI,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAChI;AACD;"}

package/dist/development/src/model/service/InviteManager.cjs

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const CreatePersonCommand = require("../commands/person/CreatePersonCommand.cjs");
+const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
+const CreateOrUpdateProjectMembershipCommand = require("../commands/membership/CreateOrUpdateProjectMembershipCommand.cjs");
+const Response = require("../utils/Response.cjs");
+const CreatePasswordResetRequestCommand = require("../commands/passwordReset/CreatePasswordResetRequestCommand.cjs");
+const SavePasswordResetRequestCommand = require("../commands/passwordReset/SavePasswordResetRequestCommand.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("../authorization/Roles.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const membershipUtils = require("./membershipUtils.cjs");
+const Password = require("../dtos/Password.cjs");
+const email = require("../utils/email.cjs");
+const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24;
+class InviteManager {
+  constructor(providers, mailer, projectSchemaResolver) {
+    this.providers = providers;
+    this.mailer = mailer;
+    this.projectSchemaResolver = projectSchemaResolver;
+  }
+  async invite(dbContext, {
+    email: email$1,
+    project,
+    name,
+    memberships,
+    method,
+    emailVariant,
+    noEmail = false,
+    password,
+    passwordResetTokenHash
+  }) {
+    if (!email.validateEmail(email$1.trim())) {
+      return new Response.ResponseError("INVALID_EMAIL_FORMAT", "E-mail address is not in a valid format");
+    }
+    return await dbContext.transaction(async (trx) => {
+      let person = await trx.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email$1));
+      const isNew = !person;
+      let generatedPassword = null;
+      let resetToken = null;
+      if (!person) {
+        const identityId = await trx.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand([Roles.TenantRole.PERSON]));
+        generatedPassword = password ?? (method === "CREATE_PASSWORD" ? (await this.providers.randomBytes(9)).toString("base64") : null);
+        const passwordWrapper = generatedPassword !== null ? new Password.PasswordPlain(generatedPassword) : Password.NoPassword;
+        person = await trx.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({
+          identityId,
+          email: email$1,
+          name,
+          password: passwordWrapper
+        }));
+        if (method === "RESET_PASSWORD") {
+          const result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand.CreatePasswordResetRequestCommand(person.id, await this.getInviteExpiration(project.slug)));
+          resetToken = result.token;
+        }
+        if (passwordResetTokenHash) {
+          await trx.commandBus.execute(new SavePasswordResetRequestCommand.SavePasswordResetRequestCommand(person.id, passwordResetTokenHash, await this.getInviteExpiration(project.slug)));
+        }
+      }
+      for (const membershipUpdate of membershipUtils.createAppendMembershipVariables(memberships)) {
+        await trx.commandBus.execute(new CreateOrUpdateProjectMembershipCommand.CreateOrUpdateProjectMembershipCommand(project.id, person.identity_id, membershipUpdate));
+      }
+      if (!noEmail) {
+        const customMailOptions = {
+          projectId: project.id,
+          variant: emailVariant ?? ""
+        };
+        if (isNew) {
+          await this.mailer.sendNewUserInvitedMail(
+            trx,
+            { email: email$1, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken },
+            customMailOptions
+          );
+        } else {
+          await this.mailer.sendExistingUserInvitedEmail(trx, { email: email$1, project: project.name, projectSlug: project.slug }, customMailOptions);
+        }
+      }
+      return new Response.ResponseOk(new InviteResult(person, isNew));
+    });
+  }
+  async getInviteExpiration(projectSlug) {
+    const schema = await this.projectSchemaResolver.getSchema(projectSlug);
+    return schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES;
+  }
+}
+class InviteResult {
+  constructor(person, isNew) {
+    this.person = person;
+    this.isNew = isNew;
+  }
+}
+exports.InviteManager = InviteManager;
+exports.InviteResult = InviteResult;
+//# sourceMappingURL=InviteManager.cjs.map

package/dist/development/src/model/service/InviteManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InviteManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/InviteManager.ts"],"sourcesContent":["import {\n\tCreateIdentityCommand,\n\tCreateOrUpdateProjectMembershipCommand,\n\tCreatePasswordResetRequestCommand,\n\tCreatePersonCommand,\n\tSavePasswordResetRequestCommand,\n} from '../commands'\nimport { Providers } from '../providers'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { InviteErrorCode, InviteMethod } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { UserMailer } from '../mailing'\nimport { createAppendMembershipVariables } from './membershipUtils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { NoPassword, PasswordPlain } from '../dtos'\nimport { Acl } from '@contember/schema'\nimport { validateEmail } from '../utils/email'\n\nexport interface InviteData {\n\temail: string\n\tname?: string\n\tproject: Project\n\tmemberships: readonly Acl.Membership[]\n\tnoEmail?: boolean\n\tpassword?: string\n\temailVariant?: string\n\tmethod?: InviteMethod\n\tpasswordResetTokenHash?: TokenHash\n}\n\nconst INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24\n\nexport class InviteManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) { }\n\n\tasync invite(\n\t\tdbContext: DatabaseContext,\n\t\t{\n\t\t\temail,\n\t\t\tproject,\n\t\t\tname,\n\t\t\tmemberships,\n\t\t\tmethod,\n\t\t\temailVariant,\n\t\t\tnoEmail = false,\n\t\t\tpassword,\n\t\t\tpasswordResetTokenHash,\n\t\t}: InviteData,\n\t): Promise<InviteResponse> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tlet person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tconst isNew = !person\n\t\t\tlet generatedPassword: string | null = null\n\t\t\tlet resetToken: string | null = null\n\t\t\tif (!person) {\n\t\t\t\tconst identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))\n\n\t\t\t\tgeneratedPassword = password ??\n\t\t\t\t\t(method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)\n\t\t\t\tconst passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword\n\n\t\t\t\tperson = await trx.commandBus.execute(new CreatePersonCommand({\n\t\t\t\t\tidentityId,\n\t\t\t\t\temail,\n\t\t\t\t\tname,\n\t\t\t\t\tpassword: passwordWrapper,\n\t\t\t\t}))\n\t\t\t\tif (method === 'RESET_PASSWORD') {\n\t\t\t\t\tconst result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand(person.id, await this.getInviteExpiration(project.slug)))\n\t\t\t\t\tresetToken = result.token\n\t\t\t\t}\n\t\t\t\tif (passwordResetTokenHash) {\n\t\t\t\t\tawait trx.commandBus.execute(new SavePasswordResetRequestCommand(person.id, passwordResetTokenHash, await this.getInviteExpiration(project.slug)))\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const membershipUpdate of createAppendMembershipVariables(memberships)) {\n\t\t\t\tawait trx.commandBus.execute(new CreateOrUpdateProjectMembershipCommand(project.id, person.identity_id, membershipUpdate))\n\t\t\t}\n\t\t\tif (!noEmail) {\n\t\t\t\tconst customMailOptions = {\n\t\t\t\t\tprojectId: project.id,\n\t\t\t\t\tvariant: emailVariant ?? '',\n\t\t\t\t}\n\t\t\t\tif (isNew) {\n\t\t\t\t\tawait this.mailer.sendNewUserInvitedMail(\n\t\t\t\t\t\ttrx,\n\t\t\t\t\t\t{ email, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken },\n\t\t\t\t\t\tcustomMailOptions,\n\t\t\t\t\t)\n\t\t\t\t} else {\n\t\t\t\t\tawait this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name, projectSlug: project.slug }, customMailOptions)\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn new ResponseOk(new InviteResult(person, isNew))\n\t\t})\n\t}\n\n\tprivate async getInviteExpiration(projectSlug: string): Promise<number> {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(projectSlug)\n\n\t\treturn schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES\n\t}\n}\n\nexport type InviteResponse = Response<InviteResult, InviteErrorCode>\n\nexport class InviteResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) { }\n}\n"],"names":["email","validateEmail","ResponseError","PersonQuery","CreateIdentityCommand","TenantRole","PasswordPlain","NoPassword","CreatePersonCommand","CreatePasswordResetRequestCommand","SavePasswordResetRequestCommand","createAppendMembershipVariables","CreateOrUpdateProjectMembershipCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,4CAA4C,KAAK;AAEhD,MAAM,cAAc;AAAA,EAC1B,YACkB,WACA,QACA,uBAChB;AAHgB,SAAA,YAAA;AACA,SAAA,SAAA;AACA,SAAA,wBAAA;AAAA,EACd;AAAA,EAEJ,MAAM,OACL,WACA;AAAA,IAAA,OACCA;AAAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EAAA,GAEyB;AAC1B,QAAI,CAACC,MAAA,cAAcD,QAAM,KAAM,CAAA,GAAG;AAC1B,aAAA,IAAIE,SAAc,cAAA,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC3C,UAAA,SAA0C,MAAM,IAAI,aAAa,MAAMC,wBAAY,QAAQH,OAAK,CAAC;AACrG,YAAM,QAAQ,CAAC;AACf,UAAI,oBAAmC;AACvC,UAAI,aAA4B;AAChC,UAAI,CAAC,QAAQ;AACN,cAAA,aAAa,MAAM,IAAI,WAAW,QAAQ,IAAII,sBAAA,sBAAsB,CAACC,MAAA,WAAW,MAAM,CAAC,CAAC;AAE1E,4BAAA,aAClB,WAAW,qBAAqB,MAAM,KAAK,UAAU,YAAY,CAAC,GAAG,SAAS,QAAQ,IAAI;AAC5F,cAAM,kBAAkB,sBAAsB,OAAO,IAAIC,SAAAA,cAAc,iBAAiB,IAAIC;AAE5F,iBAAS,MAAM,IAAI,WAAW,QAAQ,IAAIC,oBAAAA,oBAAoB;AAAA,UAC7D;AAAA,UAAA,OACAR;AAAAA,UACA;AAAA,UACA,UAAU;AAAA,QACV,CAAA,CAAC;AACF,YAAI,WAAW,kBAAkB;AAChC,gBAAM,SAAS,MAAM,IAAI,WAAW,QAAQ,IAAIS,kCAAAA,kCAAkC,OAAO,IAAI,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAC1I,uBAAa,OAAO;AAAA,QACrB;AACA,YAAI,wBAAwB;AAC3B,gBAAM,IAAI,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,IAAI,wBAAwB,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAAA,QAClJ;AAAA,MACD;AACW,iBAAA,oBAAoBC,gDAAgC,WAAW,GAAG;AACtE,cAAA,IAAI,WAAW,QAAQ,IAAIC,uCAAA,uCAAuC,QAAQ,IAAI,OAAO,aAAa,gBAAgB,CAAC;AAAA,MAC1H;AACA,UAAI,CAAC,SAAS;AACb,cAAM,oBAAoB;AAAA,UACzB,WAAW,QAAQ;AAAA,UACnB,SAAS,gBAAgB;AAAA,QAAA;AAE1B,YAAI,OAAO;AACV,gBAAM,KAAK,OAAO;AAAA,YACjB;AAAA,YACA,EAAA,OAAEZ,SAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,UAAU,mBAAmB,OAAO,WAAW;AAAA,YAC1G;AAAA,UAAA;AAAA,QACD,OACM;AACN,gBAAM,KAAK,OAAO,6BAA6B,KAAK,EAAEA,OAAAA,SAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,QAAQ,iBAAiB;AAAA,QACnI;AAAA,MACD;AACA,aAAO,IAAIa,SAAW,WAAA,IAAI,aAAa,QAAQ,KAAK,CAAC;AAAA,IAAA,CACrD;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,aAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW;AAE9D,WAAA,QAAQ,SAAS,QAAQ,2BAA2B;AAAA,EAC5D;AACD;AAIO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkD,OAAgB;AAAlE,SAAA,SAAA;AAAkD,SAAA,QAAA;AAAA,EAAkB;AACjG;;;"}