@contember/engine-tenant-api 1.4.1 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -13,16 +13,16 @@
     "test": "vitest --dir ./tests/cases --no-threads"
   },
   "dependencies": {
-    "@contember/authorization": "1.4.1",
-    "@contember/config-loader": "1.4.1",
-    "@contember/database": "1.4.1",
-    "@contember/database-migrations": "1.4.1",
-    "@contember/dic": "1.4.1",
-    "@contember/graphql-utils": "1.4.1",
-    "@contember/logger": "1.4.1",
-    "@contember/schema": "1.4.1",
-    "@contember/schema-utils": "1.4.1",
-    "@contember/typesafe": "1.4.1",
+    "@contember/authorization": "1.4.3",
+    "@contember/config-loader": "1.4.3",
+    "@contember/database": "1.4.3",
+    "@contember/database-migrations": "1.4.3",
+    "@contember/dic": "1.4.3",
+    "@contember/graphql-utils": "1.4.3",
+    "@contember/logger": "1.4.3",
+    "@contember/schema": "1.4.3",
+    "@contember/schema-utils": "1.4.3",
+    "@contember/typesafe": "1.4.3",
     "@graphql-tools/utils": "^10.0.8",
     "graphql-tag": "^2.12.6",
     "jose": "^5.1.1",
@@ -32,7 +32,7 @@
     "otpauth": "^9.1.5"
   },
   "devDependencies": {
-    "@contember/database-tester": "1.4.1",
+    "@contember/database-tester": "1.4.3",
     "@graphql-codegen/cli": "^5.0.0",
     "@graphql-codegen/typescript": "^4.0.1",
     "@graphql-codegen/typescript-operations": "^4.0.1",

package/src/model/service/IDPSignInManager.ts

@@ -1,6 +1,6 @@
 import { ApiKeyManager } from './apiKey'
 import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'
-import { IDPClaim, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
+import { IDPResponse, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'
 import { DatabaseContext } from '../utils'
@@ -28,7 +28,7 @@ class IDPSignInManager {
 			}
 			const providerService = this.idpRegistry.getHandler(provider.type)
 			const validatedConfig = providerService.validateConfiguration(provider.configuration)
-			let claim: IDPClaim
+			let claim: IDPResponse
 			try {
 				claim = await providerService.processResponse(
 					validatedConfig,
@@ -54,7 +54,7 @@ class IDPSignInManager {
 			}
 
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
-			return new ResponseOk({ person: personRow, token: sessionToken })
+			return new ResponseOk({ person: personRow, token: sessionToken, idpResponse: claim })
 		})
 	}
 
@@ -84,7 +84,7 @@ class IDPSignInManager {
 		}
 	}
 
-	private async resolvePerson(db: DatabaseContext, claim: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow | null> {
+	private async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow | null> {
 		const personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)
 		const personByIdp = await db.queryHandler.fetch(personByIdPQuery)
 		if (personByIdp) {
@@ -108,7 +108,7 @@ class IDPSignInManager {
 		return null
 	}
 
-	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow> {
+	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {
 		const roles = [TenantRole.PERSON]
 		const identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))
 		const newPerson = await db.commandBus.execute(new CreatePersonCommand({
@@ -125,7 +125,7 @@ class IDPSignInManager {
 		}
 	}
 
-	private async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPClaim, person: PersonRow) {
+	private async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {
 		await db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))
 	}
 }
@@ -136,6 +136,7 @@ namespace IDPSignInManager {
 	interface SignInIDPResult {
 		readonly person: PersonRow
 		readonly token: string
+		readonly idpResponse?: Record<string, unknown>
 	}
 
 	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>

package/src/model/service/idp/IdentityProviderHandler.ts

@@ -3,17 +3,17 @@ export interface InitIDPAuthResult {
 	sessionData: unknown
 }
 
-export interface IDPClaim {
+export type IDPResponse = {
 	externalIdentifier: string
 	email?: string
 	name?: string
-}
+} & Record<string, unknown>
 
 export interface IdentityProviderHandler<Configuration extends {}> {
 
 	initAuth: (configuration: Configuration, data: unknown) => Promise<InitIDPAuthResult>
 
-	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPClaim>
+	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPResponse>
 
 	validateConfiguration: (config: unknown) => Configuration
 

package/src/model/service/idp/providers/AppleProvider.ts

@@ -1,5 +1,5 @@
 import * as Typesafe from '@contember/typesafe'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'
 import { catchTypesafe } from './helpers'
 import { IDPValidationError } from '../IDPValidationError'
@@ -36,7 +36,7 @@ export class AppleProvider implements IdentityProviderHandler<AppleConfiguration
 		})
 	}
 
-	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await handleOIDCResponse(client, responseData)

package/src/model/service/idp/providers/FacebookProvider.ts

@@ -1,6 +1,6 @@
 import * as Typesafe from '@contember/typesafe'
 import { Client, Issuer } from 'openid-client'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { IDPValidationError } from '../IDPValidationError'
 import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
 import { catchTypesafe } from './helpers'
@@ -85,7 +85,7 @@ export class FacebookProvider implements IdentityProviderHandler<FacebookConfigu
 		})
 	}
 
-	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)
 
 		if (!('authResponse' in responseData)) {

package/src/model/service/idp/providers/OIDCHelpers.ts

@@ -2,7 +2,7 @@ import { Client, custom, errors, generators } from 'openid-client'
 import { OIDCResponseData } from './OIDCTypes'
 import { IDPValidationError } from '../IDPValidationError'
 import { IDPResponseError } from '../IDPResponseError'
-import { IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 
 custom.setHttpOptionsDefaults({
 	timeout: 5000,
@@ -25,7 +25,7 @@ export const initOIDCAuth = async (client: Client, { redirectUrl, claims, respon
 	}
 }
 
-export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPClaim> => {
+export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPResponse> => {
 	const params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)
 	if (params.state && !sessionData?.state) {
 		throw new IDPValidationError(`state is present in parameters, but missing in session data`)
@@ -33,10 +33,10 @@ export const handleOIDCResponse = async (client: Client, { sessionData, redirect
 	try {
 		const result = await client.callback(redirectUrl, params, sessionData)
 		const claims = result.claims()
+		const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims
 		return {
 			externalIdentifier: claims.sub,
-			email: claims.email,
-			name: claims.name,
+			...claimsWithoutHashes,
 		}
 	} catch (e: any) {
 		if (e instanceof errors.RPError) {

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -1,5 +1,5 @@
 import { Client, Issuer } from 'openid-client'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
 import { catchTypesafe } from './helpers'
 import { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'
@@ -21,7 +21,7 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 		})
 	}
 
-	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await handleOIDCResponse(client, responseData)
@@ -40,6 +40,7 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 				client_id: configuration.clientId,
 				client_secret: configuration.clientSecret,
 				response_types: [configuration.responseType || 'code'],
+				id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',
 			},
 			undefined,
 			{

package/src/model/service/idp/providers/OIDCTypes.ts

@@ -10,6 +10,7 @@ export const OIDCConfigurationOptions = Typesafe.partial({
 	responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
 	claims: Typesafe.string,
 	additionalAuthorizedParties: Typesafe.array(Typesafe.string),
+	idTokenSignedResponseAlg: Typesafe.string,
 })
 export const BaseOIDCConfiguration = Typesafe.intersection(
 	Typesafe.object({

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -55,7 +55,10 @@ export class IDPMutationResolver implements MutationResolvers {
 		return {
 			ok: true,
 			errors: [],
-			result: await this.signInResponseFactory.createResponse(signIn.result, context),
+			result: {
+				...await this.signInResponseFactory.createResponse(signIn.result, context),
+				idpResponse: signIn.result.idpResponse,
+			},
 		}
 	}
 }

package/src/schema/index.ts

@@ -1138,6 +1138,7 @@ export type SignInIdpResponse = {
 
 export type SignInIdpResult = CommonSignInResult & {
 	readonly __typename?: 'SignInIDPResult'
+	readonly idpResponse?: Maybe<Scalars['Json']['output']>
 	readonly person: Person
 	readonly token: Scalars['String']['output']
 }
@@ -2238,6 +2239,7 @@ export type SignInIdpResponseResolvers<ContextType = any, ParentType extends Res
 }
 
 export type SignInIdpResultResolvers<ContextType = any, ParentType extends ResolversParentTypes['SignInIDPResult'] = ResolversParentTypes['SignInIDPResult']> = {
+	idpResponse?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
 	person?: Resolver<ResolversTypes['Person'], ParentType, ContextType>
 	token?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>

package/src/schema/tenant.graphql.ts

@@ -336,6 +336,7 @@ const schema: DocumentNode = gql`
 	type SignInIDPResult implements CommonSignInResult {
 		token: String!
 		person: Person!
+		idpResponse: Json
 	}
 
 	type AddIDPResponse {

package/tests/src/IdPMock.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../../src'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../../src'
 
 export class IdPMock implements IdentityProviderHandler<any> {
 	initAuth(configuration: any, data: unknown): Promise<InitIDPAuthResult> {
@@ -8,7 +8,7 @@ export class IdPMock implements IdentityProviderHandler<any> {
 		})
 	}
 
-	processResponse(configuration: any, responseData: any): Promise<IDPClaim> {
+	processResponse(configuration: any, responseData: any): Promise<IDPResponse> {
 		return Promise.resolve({
 			externalIdentifier: configuration.externalIdentifier,
 			email: configuration.email,