@contember/engine-tenant-api 1.4.0-rc.8 → 2.0.0-alpha.8

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.js

@@ -0,0 +1,73 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import { IdentityScope } from "../../../model/authorization/IdentityScope.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/authorization";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/OIDCHelpers.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class ChangeProfileMutationResolver {
+  constructor(personManager) {
+    this.personManager = personManager;
+  }
+  async changeProfile(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId));
+    if (!person) {
+      return createErrorResponse("PERSON_NOT_FOUND", "Person not found");
+    }
+    if (args.email === null) {
+      return createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
+    }
+    await context.requireAccess({
+      scope: new IdentityScope(person.identity_id),
+      action: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),
+      message: "You are not allowed to change a profile"
+    });
+    const result = await this.personManager.changeProfile(context.db, person, {
+      email: args.email,
+      name: args.name === "" ? null : args.name
+    });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async changeMyProfile(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      return createErrorResponse("NOT_A_PERSON", "Only a person can change a profile.");
+    }
+    if (args.email === null) {
+      return createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
+    }
+    await context.requireAccess({
+      action: PermissionActions.PERSON_CHANGE_MY_PROFILE,
+      message: "You are not allowed to change profile"
+    });
+    const result = await this.personManager.changeProfile(context.db, person, {
+      email: args.email,
+      name: args.name === "" ? null : args.name
+    });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+export {
+  ChangeProfileMutationResolver
+};
+//# sourceMappingURL=ChangeProfileMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangeProfileMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IdentityScope, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t) { }\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAAsG;AAAA,EAClH,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EACd;AAAA,EAEJ,MAAM,cACL,QACA,MACA,SACA,MACiC;AAC3B,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACI,QAAA,KAAK,UAAU,MAAM;AACjB,aAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AAEG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEO,WAAA,EAAE,IAAI;EACd;AAAA,EAGA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AAC7B,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACI,QAAA,KAAK,UAAU,MAAM;AACjB,aAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AAEG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEO,WAAA,EAAE,IAAI;EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/OIDCHelpers.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class DisablePersonMutationResolver {
+  constructor(personAccessManager, personManager) {
+    this.personAccessManager = personAccessManager;
+    this.personManager = personManager;
+  }
+  async disablePerson(parent, args, context) {
+    const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
+    if (targetPerson === null) {
+      return {
+        ok: false,
+        error: {
+          code: "PERSON_NOT_FOUND",
+          developerMessage: `Person <${args.personId}> was not found`
+        }
+      };
+    }
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_DISABLE(targetPerson.roles),
+      message: "You are not allowed to disable person account"
+    });
+    const result = await this.personAccessManager.disablePerson(context.db, args.personId);
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return {
+      ok: true
+    };
+  }
+}
+exports.DisablePersonMutationResolver = DisablePersonMutationResolver;
+//# sourceMappingURL=DisablePersonMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import {\n\tDisablePersonResponse,\n\tMutationDisablePersonArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, args.personId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,8BAA2D;AAAA,EAEvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QAAa,MAAiC,SACb;AAC3B,UAAA,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AACnB,aAAA;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAC3C;AAAA,MAAA;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAEjF,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEO,WAAA;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.js

@@ -0,0 +1,52 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/OIDCHelpers.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class DisablePersonMutationResolver {
+  constructor(personAccessManager, personManager) {
+    this.personAccessManager = personAccessManager;
+    this.personManager = personManager;
+  }
+  async disablePerson(parent, args, context) {
+    const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
+    if (targetPerson === null) {
+      return {
+        ok: false,
+        error: {
+          code: "PERSON_NOT_FOUND",
+          developerMessage: `Person <${args.personId}> was not found`
+        }
+      };
+    }
+    await context.requireAccess({
+      action: PermissionActions.PERSON_DISABLE(targetPerson.roles),
+      message: "You are not allowed to disable person account"
+    });
+    const result = await this.personAccessManager.disablePerson(context.db, args.personId);
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return {
+      ok: true
+    };
+  }
+}
+export {
+  DisablePersonMutationResolver
+};
+//# sourceMappingURL=DisablePersonMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import {\n\tDisablePersonResponse,\n\tMutationDisablePersonArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, args.personId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAUO,MAAM,8BAA2D;AAAA,EAEvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QAAa,MAAiC,SACb;AAC3B,UAAA,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AACnB,aAAA;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAC3C;AAAA,MAAA;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAEjF,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEO,WAAA;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.cjs

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/OIDCHelpers.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class IDPMutationResolver {
+  constructor(idpSignInManager, signInResponseFactory) {
+    this.idpSignInManager = idpSignInManager;
+    this.signInResponseFactory = signInResponseFactory;
+  }
+  async initSignInIDP(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_CREATE_IDP_URL,
+      message: "You are not allowed to create a redirect URL for IDP"
+    });
+    const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {
+      redirectUrl: args.redirectUrl
+    });
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true, errors: [], result: result.result };
+  }
+  async signInIDP(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_SIGN_IN_IDP,
+      message: "You are not allowed to person IDP sign in"
+    });
+    const signIn = await this.idpSignInManager.signInIDP(
+      context.db,
+      args.identityProvider,
+      args.data ?? {
+        sessionData: args.sessionData,
+        url: args.idpResponse?.url,
+        redirectUrl: args.redirectUrl
+      },
+      args.expiration ?? void 0
+    );
+    if (!signIn.ok) {
+      return errorUtils.createErrorResponse(signIn.error, signIn.errorMessage);
+    }
+    return {
+      ok: true,
+      errors: [],
+      result: await this.signInResponseFactory.createResponse(signIn.result, context)
+    };
+  }
+}
+exports.IDPMutationResolver = IDPMutationResolver;
+//# sourceMappingURL=IDPMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAI,GAAA,QAAQ,OAAO;EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IAAA;AAEhB,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AACD;;"}

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.js

@@ -0,0 +1,66 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/OIDCHelpers.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class IDPMutationResolver {
+  constructor(idpSignInManager, signInResponseFactory) {
+    this.idpSignInManager = idpSignInManager;
+    this.signInResponseFactory = signInResponseFactory;
+  }
+  async initSignInIDP(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_CREATE_IDP_URL,
+      message: "You are not allowed to create a redirect URL for IDP"
+    });
+    const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {
+      redirectUrl: args.redirectUrl
+    });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true, errors: [], result: result.result };
+  }
+  async signInIDP(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_SIGN_IN_IDP,
+      message: "You are not allowed to person IDP sign in"
+    });
+    const signIn = await this.idpSignInManager.signInIDP(
+      context.db,
+      args.identityProvider,
+      args.data ?? {
+        sessionData: args.sessionData,
+        url: args.idpResponse?.url,
+        redirectUrl: args.redirectUrl
+      },
+      args.expiration ?? void 0
+    );
+    if (!signIn.ok) {
+      return createErrorResponse(signIn.error, signIn.errorMessage);
+    }
+    return {
+      ok: true,
+      errors: [],
+      result: await this.signInResponseFactory.createResponse(signIn.result, context)
+    };
+  }
+}
+export {
+  IDPMutationResolver
+};
+//# sourceMappingURL=IDPMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAI,GAAA,QAAQ,OAAO;EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IAAA;AAEhB,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AACD;"}

package/dist/production/src/resolvers/mutation/person/InviteMutationResolver.cjs

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+const tokenUtils = require("../../../model/utils/tokenUtils.cjs");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/OIDCHelpers.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const membershipUtils = require("../../membershipUtils.cjs");
+const errorUtils = require("../../errorUtils.cjs");
+const graphqlUtils = require("@contember/graphql-utils");
+const PersonResponseFactory = require("../../responseHelpers/PersonResponseFactory.cjs");
+class InviteMutationResolver {
+  constructor(inviteManager, projectManager, membershipValidator) {
+    this.inviteManager = inviteManager;
+    this.projectManager = projectManager;
+    this.membershipValidator = membershipValidator;
+  }
+  async invite(parent, { projectSlug, email, name, memberships, options }, context) {
+    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
+    await context.requireAccess({
+      scope: await context.permissionContext.createProjectScope(project),
+      action: PermissionActions.PermissionActions.PERSON_INVITE(memberships),
+      message: "You are not allowed to invite a person"
+    });
+    if (!project) {
+      return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
+    }
+    return this.doInvite(context.db, {
+      email,
+      project,
+      memberships,
+      name: name ?? void 0,
+      emailVariant: options?.mailVariant || "",
+      method: options?.method ?? "CREATE_PASSWORD"
+    });
+  }
+  async unmanagedInvite(parent, { projectSlug, email, memberships, password, options }, context) {
+    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
+    await context.requireAccess({
+      scope: await context.permissionContext.createProjectScope(project),
+      action: PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED(memberships),
+      message: "You are not allowed to unmanaged person invite"
+    });
+    if (!project) {
+      return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
+    }
+    if (typeof options?.resetTokenHash === "string" && !tokenUtils.isTokenHash(options?.resetTokenHash)) {
+      throw new graphqlUtils.UserInputError("Invalid format of resetTokenHash. Must be hex-encoded sha256.");
+    }
+    return this.doInvite(context.db, {
+      email,
+      project,
+      memberships,
+      noEmail: true,
+      password: password ?? options?.password ?? void 0,
+      passwordResetTokenHash: options?.resetTokenHash ?? void 0
+    });
+  }
+  async doInvite(dbContext, invite) {
+    const validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships);
+    if (validationResult.length > 0) {
+      const errors = membershipUtils.createMembershipValidationErrorResult(validationResult);
+      return {
+        ok: false,
+        errors,
+        error: errors[0]
+      };
+    }
+    const response = await this.inviteManager.invite(dbContext, invite);
+    if (!response.ok) {
+      return errorUtils.createErrorResponse(response.error, response.errorMessage);
+    }
+    const result = response.result;
+    return {
+      ok: true,
+      errors: [],
+      result: {
+        person: PersonResponseFactory.PersonResponseFactory.createPersonResponse(result.person),
+        isNew: result.isNew
+      }
+    };
+  }
+}
+exports.InviteMutationResolver = InviteMutationResolver;
+//# sourceMappingURL=InviteMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/InviteMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACO,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EACF;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACI,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAACC,uBAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAIC,aAAAA,eAAe,+DAA+D;AAAA,IACzF;AACO,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EACF;AAAA,EAEA,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAASC,sDAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MACf;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/mutation/person/InviteMutationResolver.js

@@ -0,0 +1,98 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import { isTokenHash } from "../../../model/utils/tokenUtils.js";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/OIDCHelpers.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
+import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
+import { UserInputError } from "@contember/graphql-utils";
+import { PersonResponseFactory } from "../../responseHelpers/PersonResponseFactory.js";
+class InviteMutationResolver {
+  constructor(inviteManager, projectManager, membershipValidator) {
+    this.inviteManager = inviteManager;
+    this.projectManager = projectManager;
+    this.membershipValidator = membershipValidator;
+  }
+  async invite(parent, { projectSlug, email, name, memberships, options }, context) {
+    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
+    await context.requireAccess({
+      scope: await context.permissionContext.createProjectScope(project),
+      action: PermissionActions.PERSON_INVITE(memberships),
+      message: "You are not allowed to invite a person"
+    });
+    if (!project) {
+      return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
+    }
+    return this.doInvite(context.db, {
+      email,
+      project,
+      memberships,
+      name: name ?? void 0,
+      emailVariant: options?.mailVariant || "",
+      method: options?.method ?? "CREATE_PASSWORD"
+    });
+  }
+  async unmanagedInvite(parent, { projectSlug, email, memberships, password, options }, context) {
+    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
+    await context.requireAccess({
+      scope: await context.permissionContext.createProjectScope(project),
+      action: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),
+      message: "You are not allowed to unmanaged person invite"
+    });
+    if (!project) {
+      return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
+    }
+    if (typeof options?.resetTokenHash === "string" && !isTokenHash(options?.resetTokenHash)) {
+      throw new UserInputError("Invalid format of resetTokenHash. Must be hex-encoded sha256.");
+    }
+    return this.doInvite(context.db, {
+      email,
+      project,
+      memberships,
+      noEmail: true,
+      password: password ?? options?.password ?? void 0,
+      passwordResetTokenHash: options?.resetTokenHash ?? void 0
+    });
+  }
+  async doInvite(dbContext, invite) {
+    const validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships);
+    if (validationResult.length > 0) {
+      const errors = createMembershipValidationErrorResult(validationResult);
+      return {
+        ok: false,
+        errors,
+        error: errors[0]
+      };
+    }
+    const response = await this.inviteManager.invite(dbContext, invite);
+    if (!response.ok) {
+      return createErrorResponse(response.error, response.errorMessage);
+    }
+    const result = response.result;
+    return {
+      ok: true,
+      errors: [],
+      result: {
+        person: PersonResponseFactory.createPersonResponse(result.person),
+        isNew: result.isNew
+      }
+    };
+  }
+}
+export {
+  InviteMutationResolver
+};
+//# sourceMappingURL=InviteMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/InviteMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACO,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EACF;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACI,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAI,eAAe,+DAA+D;AAAA,IACzF;AACO,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EACF;AAAA,EAEA,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAAS,sCAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MACf;AAAA,IAAA;AAAA,EAEF;AACD;"}