@contember/engine-tenant-api 2.0.0-alpha.14 → 2.0.0-alpha.16

package/src/model/mailing/templates/PasswordlessSignIn.mustache.ts

@@ -0,0 +1,15 @@
+import Layout from './Layout.mustache'
+// language=Mustache
+export default Layout(`
+	<p>Hello,</p>
+	<p>
+		sign in was requested for your account ({{email}}):<br>
+		{{#url}}
+			<p>Click the following link to sign in:</p>
+			<a href="{{url}}">{{url}}</a>
+		{{/url}}
+		{{^url}}
+			<p>Passwordless sign-in is misconfigured. Please contact your administrator.</p>
+		{{/url}}
+	</p>
+`)

package/src/model/mailing/type.ts

@@ -4,6 +4,7 @@ export enum MailType {
 	existingUserInvited = 'existingUserInvited',
 	newUserInvited = 'newUserInvited',
 	passwordReset = 'passwordReset',
+	passwordlessSignIn = 'passwordlessSignIn',
 }
 
 export const mailTypeFromSchemaToDb = (type: SchemaMailType): MailType => {
@@ -11,6 +12,7 @@ export const mailTypeFromSchemaToDb = (type: SchemaMailType): MailType => {
 		EXISTING_USER_INVITED: MailType.existingUserInvited,
 		NEW_USER_INVITED: MailType.newUserInvited,
 		RESET_PASSWORD_REQUEST: MailType.passwordReset,
+		PASSWORDLESS_SIGN_IN: MailType.passwordlessSignIn,
 	}[type]
 }
 
@@ -19,6 +21,7 @@ export const mailTypeFromDbToSchema = (type: MailType): SchemaMailType => {
 		[MailType.existingUserInvited]: 'EXISTING_USER_INVITED' as const,
 		[MailType.newUserInvited]: 'NEW_USER_INVITED' as const,
 		[MailType.passwordReset]: 'RESET_PASSWORD_REQUEST' as const,
+		[MailType.passwordlessSignIn]: 'PASSWORDLESS_SIGN_IN' as const,
 	}[type]
 }
 

package/src/model/queries/configuration/ConfigurationQuery.ts

@@ -0,0 +1,30 @@
+import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'
+import { Config, ConfigPolicy } from '../../../schema'
+
+export class ConfigurationQuery extends DatabaseQuery<Config> {
+
+	async fetch({ db }: DatabaseQueryable): Promise<Config> {
+		const rows = await SelectBuilder.create<ConfigurationRow>()
+			.from('config')
+			.select(new Literal('*'))
+			.getResult(db)
+		const result = this.fetchOneOrNull(rows)
+		if (!result) {
+			throw new Error('Configuration not found')
+		}
+
+		return {
+			passwordless: {
+				enabled: result.passwordless_enabled,
+				url: result.passwordless_url,
+				expirationMinutes: result.passwordless_expiration_minutes,
+			},
+		}
+	}
+}
+
+interface ConfigurationRow {
+	passwordless_enabled: ConfigPolicy
+	passwordless_url: string | null
+	passwordless_expiration_minutes: number
+}

package/src/model/queries/configuration/index.ts

@@ -0,0 +1 @@
+export * from './ConfigurationQuery'

package/src/model/queries/index.ts

@@ -1,4 +1,5 @@
 export * from './apiKey'
+export * from './configuration'
 export * from './mailTemplate'
 export * from './membership'
 export * from './person'

package/src/model/queries/person/PersonQueryBuilderFactory.ts

@@ -12,6 +12,7 @@ export class PersonQueryBuilderFactory {
 			.select(['person', 'email'])
 			.select(['person', 'name'])
 			.select(['person', 'disabled_at'])
+			.select(['person', 'passwordless_enabled'])
 			.select(['identity', 'roles'])
 			.from('person')
 			.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))

package/src/model/queries/person/types.ts

@@ -8,6 +8,7 @@ export interface PersonRow {
 	readonly name: string | null
 	readonly roles: string[]
 	readonly disabled_at: Date | null
+	readonly passwordless_enabled: boolean | null
 }
 
 export type MaybePersonRow = PersonRow | null

package/src/model/queries/personToken/PersonTokenQuery.ts

@@ -0,0 +1,35 @@
+import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'
+import { PersonToken } from '../../type'
+import { computeTokenHash } from '../../utils'
+
+export class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {
+
+	private constructor(
+		private readonly identifierType: 'id' | 'token_hash',
+		private readonly identifier: string,
+		private readonly type: PersonToken.Type,
+	) {
+		super()
+	}
+
+	public static byId(id: string, type: PersonToken.Type): PersonTokenQuery {
+		return new PersonTokenQuery('id', id, type)
+	}
+
+	public static byToken(token: string, type: PersonToken.Type): PersonTokenQuery {
+		const tokenHash = computeTokenHash(token)
+		return new PersonTokenQuery('token_hash', tokenHash, type)
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null> {
+		const result = await SelectBuilder.create<PersonToken.Row>()
+			.from('person_token')
+			.select(new Literal('*'))
+			.where({
+				[this.identifierType]: this.identifier,
+				type: this.type,
+			})
+			.getResult(db)
+		return this.fetchOneOrNull(result)
+	}
+}

package/src/model/service/ConfigurationManager.ts

@@ -0,0 +1,22 @@
+import { Config, ConfigInput, ConfigureErrorCode } from '../../schema'
+import { Response, ResponseOk } from '../utils/Response'
+import { DatabaseContext } from '../utils'
+import { UpdateConfigurationCommand } from '../commands'
+import { ConfigurationQuery } from '../queries'
+
+export class ConfigurationManager {
+	constructor() {
+	}
+
+	public async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {
+		// todo: validate configuration
+
+		await db.commandBus.execute(new UpdateConfigurationCommand(configuration))
+
+		return new ResponseOk(null)
+	}
+
+	public async fetchConfiguration(db: DatabaseContext): Promise<Config> {
+		return await db.queryHandler.fetch(new ConfigurationQuery())
+	}
+}

package/src/model/service/InviteManager.ts

@@ -1,9 +1,9 @@
 import {
 	CreateIdentityCommand,
 	CreateOrUpdateProjectMembershipCommand,
-	CreatePasswordResetRequestCommand,
 	CreatePersonCommand,
-	SavePasswordResetRequestCommand,
+	CreatePersonTokenCommand,
+	SavePersonTokenCommand,
 } from '../commands'
 import { Providers } from '../providers'
 import { PersonQuery, PersonRow } from '../queries'
@@ -17,6 +17,7 @@ import { DatabaseContext, TokenHash } from '../utils'
 import { NoPassword, PasswordPlain } from '../dtos'
 import { Acl } from '@contember/schema'
 import { validateEmail } from '../utils/email'
+import { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'
 
 export interface InviteData {
 	email: string
@@ -30,8 +31,6 @@ export interface InviteData {
 	passwordResetTokenHash?: TokenHash
 }
 
-const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24
-
 export class InviteManager {
 	constructor(
 		private readonly providers: Providers,
@@ -76,11 +75,11 @@ export class InviteManager {
 					password: passwordWrapper,
 				}))
 				if (method === 'RESET_PASSWORD') {
-					const result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand(person.id, await this.getInviteExpiration(project.slug)))
+					const result = await trx.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)))
 					resetToken = result.token
 				}
 				if (passwordResetTokenHash) {
-					await trx.commandBus.execute(new SavePasswordResetRequestCommand(person.id, passwordResetTokenHash, await this.getInviteExpiration(project.slug)))
+					await trx.commandBus.execute(new SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)))
 				}
 			}
 			for (const membershipUpdate of createAppendMembershipVariables(memberships)) {

package/src/model/service/PasswordResetManager.ts

@@ -1,4 +1,3 @@
-import { CreatePasswordResetRequestCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands'
 import { Response, ResponseError } from '../utils/Response'
 import { getPasswordWeaknessMessage } from '../utils/password'
 import { UserMailer } from '../mailing'
@@ -7,6 +6,8 @@ import { PermissionContext } from '../authorization'
 import { ProjectManager } from './ProjectManager'
 import { DatabaseContext } from '../utils'
 import { ImplementationException } from '../../exceptions'
+import { getPreferredProject } from './helpers/getPreferredProject'
+import { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'
 
 interface MailOptions {
 	project?: string
@@ -25,16 +26,9 @@ export class PasswordResetManager {
 		person: PersonRow,
 		mailOptions: MailOptions = {},
 	): Promise<void> {
-		const result = await dbContext.commandBus.execute(new CreatePasswordResetRequestCommand(person.id))
+		const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))
 		const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)
-		const project = (() => {
-			if (projects.length === 1) {
-				return projects[0]
-			} else if (mailOptions.project) {
-				return projects.find(it => it.slug === mailOptions.project) || null
-			}
-			return null
-		})()
+		const project = getPreferredProject(projects, mailOptions.project ?? null)
 		if (!person.email) {
 			throw new ImplementationException()
 		}

package/src/model/service/PasswordlessSignInManager.ts

@@ -0,0 +1,190 @@
+import { ApiKeyManager } from './apiKey'
+import { PersonQuery, PersonRow } from '../queries'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import {
+	ActivatePasswordlessOtpErrorCode,
+	ConfigPolicy,
+	InitSignInPasswordlessErrorCode,
+	InitSignInPasswordlessResult,
+	SignInPasswordlessErrorCode,
+} from '../../schema'
+import { DatabaseContext, validateToken } from '../utils'
+import { ConfigurationManager } from './ConfigurationManager'
+import { UserMailer } from '../mailing'
+import { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'
+import { getPreferredProject } from './helpers/getPreferredProject'
+import { ProjectManager } from './ProjectManager'
+import { PermissionContext } from '../authorization'
+import { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'
+import { ImplementationException } from '../../exceptions'
+import { OtpAuthenticator } from './OtpAuthenticator'
+import { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'
+import { PersonToken } from '../type'
+
+class PasswordlessSignInManager {
+	constructor(
+		private readonly apiKeyManager: ApiKeyManager,
+		private readonly configurationManager: ConfigurationManager,
+		private readonly mailer: UserMailer,
+		private readonly projectManager: ProjectManager,
+		private readonly otpAuthenticator: OtpAuthenticator,
+
+	) {}
+
+	async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {
+		db: DatabaseContext
+		permissionContext: PermissionContext
+		email: string
+		mailVariant?: string
+		mailProject?: string
+	}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {
+		return db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {
+			const configuration = await this.configurationManager.fetchConfiguration(db)
+			if (configuration.passwordless.enabled === 'never') {
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')
+			}
+
+			const person = await db.queryHandler.fetch(PersonQuery.byEmail(email))
+			if (!person) {
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)
+			}
+			if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+			}
+
+			const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)
+			const result = await db.commandBus.execute(createTokenCommand)
+
+
+			const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined
+
+			const projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)
+			const project = getPreferredProject(projects, mailProject ?? null)
+
+			await this.mailer.sendPasswordlessEmail(db, {
+				email,
+				token: result.token,
+				url,
+				project: project?.name,
+				projectSlug: project?.slug,
+			}, {
+				variant: mailVariant || '',
+				projectId: project?.id ?? null,
+			})
+
+			return new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })
+		})
+	}
+
+	private formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {
+		if (!url) {
+			return null
+		}
+		const urlObj = new URL(url)
+		urlObj.searchParams.set('token', token)
+		urlObj.searchParams.set('request_id', requestId)
+		urlObj.searchParams.set('email', email)
+		return urlObj.toString()
+	}
+
+	async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {
+		db: DatabaseContext
+		validationType: PersonToken.ValidationType
+		requestId: string
+		token: string
+		mfaOtp?: string
+		expiration?: number
+	}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {
+		return db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {
+
+			const tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))
+			const tokenValidationResult = validateToken({
+				entry: tokenResult,
+				token,
+				now: db.providers.now(),
+				validationType,
+			})
+			if (!tokenValidationResult.ok) {
+				if (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {
+					await db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))
+				}
+				return tokenValidationResult
+			}
+			const personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))
+			if (!personRow) {
+				throw new ImplementationException()
+			}
+			if (personRow.disabled_at !== null) {
+				return new ResponseError('PERSON_DISABLED', `Person is disabled`)
+			}
+
+			if (personRow.otp_uri && personRow.otp_activated_at) {
+				if (!mfaOtp) {
+					return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
+				}
+
+				if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+					return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
+				}
+			}
+
+			await db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))
+			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
+
+			return new ResponseOk({ person: personRow, token: sessionToken })
+		})
+	}
+
+	async activatePasswordlessOtp({ db, token, requestId, otpHash }: {
+		db: DatabaseContext
+		requestId: string
+		token: string
+		otpHash: string
+	}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {
+		return db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {
+
+			const tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))
+			const tokenValidationResult = validateToken({
+				entry: tokenResult,
+				token,
+				now: db.providers.now(),
+				validationType: 'token',
+			})
+			if (!tokenValidationResult.ok) {
+				return tokenValidationResult
+			}
+
+			await db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))
+
+			return new ResponseOk(null)
+		})
+	}
+
+	private isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {
+		switch (globalValue) {
+			case 'always':
+				return true
+			case 'never':
+				return false
+			case 'optIn':
+				return personValue === true
+			case 'optOut':
+				return personValue !== false
+		}
+	}
+}
+
+namespace PasswordlessSignInManager {
+	export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>
+
+
+	interface SignInPasswordlessResult {
+		readonly person: PersonRow
+		readonly token: string
+	}
+	export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>
+
+	export type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>
+}
+
+export { PasswordlessSignInManager }

package/src/model/service/PersonManager.ts

@@ -3,6 +3,7 @@ import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { PersonQuery, PersonRow } from '../queries'
 import { DatabaseContext } from '../utils'
 import { EmailValidator, EmailValidatorError } from './EmailValidator'
+import { TogglePersonPasswordlessCommand } from '../commands'
 
 class PersonManager {
 	constructor(
@@ -27,6 +28,11 @@ class PersonManager {
 		return new ResponseOk(null)
 	}
 
+	async togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {
+		await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))
+		return new ResponseOk(null)
+	}
+
 }
 
 namespace PersonManager {

package/src/model/service/PersonTokenManager.ts

@@ -0,0 +1,2 @@
+class PersonTokenManager {
+}

package/src/model/service/helpers/getPreferredProject.ts

@@ -0,0 +1,11 @@
+import { Project } from '../../type'
+
+export const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {
+	if (projects.length === 1) {
+		return projects[0]
+	}
+	if (preferredProjectSlug) {
+		return projects.find(it => it.slug === preferredProjectSlug) || null
+	}
+	return null
+}

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -40,6 +40,7 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 				client_id: configuration.clientId,
 				client_secret: configuration.clientSecret,
 				response_types: [configuration.responseType || 'code'],
+				id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',
 			},
 			undefined,
 			{

package/src/model/service/idp/providers/OIDCTypes.ts

@@ -10,6 +10,7 @@ export const OIDCConfigurationOptions = Typesafe.partial({
 	responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
 	claims: Typesafe.string,
 	additionalAuthorizedParties: Typesafe.array(Typesafe.string),
+	idTokenSignedResponseAlg: Typesafe.string,
 })
 export const BaseOIDCConfiguration = Typesafe.intersection(
 	Typesafe.object({

package/src/model/type/PersonToken.ts

@@ -0,0 +1,21 @@
+export namespace PersonToken {
+	export type Type = 'password_reset' | 'passwordless'
+	export type ValidationType = 'token' | 'otp'
+
+	export interface Row {
+		id: string
+		created_at: Date
+		token_hash: string
+		used_at: null | Date
+		expires_at: Date
+		person_id: string
+		otp_hash: string | null
+		otp_attempts: number
+	}
+
+	export type TokenValidationError =
+		| 'TOKEN_NOT_FOUND'
+		| 'TOKEN_INVALID'
+		| 'TOKEN_USED'
+		| 'TOKEN_EXPIRED'
+}

package/src/model/type/index.ts

@@ -2,3 +2,4 @@ export * from './ApiKey'
 export * from './IdentityProvider'
 export * from './Project'
 export * from './Variables'
+export * from './PersonToken'

package/src/model/utils/tokenUtils.ts

@@ -1,5 +1,8 @@
 import crypto from 'node:crypto'
 import { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'
+import { PersonToken } from '../type'
+import { ImplementationException } from '../../exceptions'
+import { Response, ResponseError, ResponseOk } from './Response'
 
 export const generateToken = async (generator: {
 	randomBytes: (bytes: number) => Promise<Buffer>
@@ -17,3 +20,47 @@ export const computeTokenHash = (token: string): TokenHash => {
 }
 
 export const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)
+
+
+const MAX_OTP_ATTEMPTS = 3
+
+export const validateToken = ({ entry, validationType, token, now }: {
+	entry: PersonToken.Row | null
+	validationType: PersonToken.ValidationType
+	token: string
+	now: Date
+}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {
+	if (!entry) {
+		return new ResponseError('TOKEN_NOT_FOUND', 'Token not found')
+	}
+	if (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {
+		return new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')
+	}
+	switch (validationType) {
+		case 'token':
+			if (entry.otp_hash !== null) {
+				return new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')
+			}
+			if (entry.token_hash !== computeTokenHash(token)) {
+				return new ResponseError('TOKEN_INVALID', 'Token invalid')
+			}
+			break
+		case 'otp':
+			if (entry.otp_hash === null) {
+				return new ResponseError('TOKEN_INVALID', 'OTP not set')
+			}
+			if (entry.otp_hash !== computeTokenHash(token)) {
+				return new ResponseError('TOKEN_INVALID', 'OTP invalid')
+			}
+			break
+		default:
+			throw new ImplementationException()
+	}
+	if (entry.used_at) {
+		return new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())
+	}
+	if (entry.expires_at < now) {
+		return new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())
+	}
+	return new ResponseOk(entry)
+}

package/src/resolvers/ResolverFactory.ts

@@ -31,6 +31,10 @@ import { IDPQueryResolver } from './query/IDPQueryResolver'
 import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver'
 import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver'
 import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver'
+import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver'
+import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver'
+import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver'
+import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver'
 
 class ResolverFactory {
 	public constructor(
@@ -53,6 +57,7 @@ class ResolverFactory {
 			disableIdpMutationResolver: DisableIDPMutationResolver
 			enableIdpMutationResolver: EnableIDPMutationResolver
 			updateIdpMutationResolver: UpdateIDPMutationResolver
+			passwordlessMutationResolver: PasswordlessMutationResolver
 
 			disablePersonMutationResolver: DisablePersonMutationResolver
 
@@ -77,6 +82,11 @@ class ResolverFactory {
 
 			identityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver
 
+			configurationMutationResolver: ConfigurationMutationResolver
+			configurationQueryResolver: ConfigurationQueryResolver
+
+			togglePasswordlessMutationResolver: TogglePasswordlessMutationResolver
+
 		},
 	) { }
 
@@ -102,6 +112,7 @@ class ResolverFactory {
 				projectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),
 				identityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),
 				mailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),
+				configuration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),
 				checkResetPasswordToken: () => {
 					throw new Error('not implemented')
 				},
@@ -127,6 +138,12 @@ class ResolverFactory {
 				updateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),
 				disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
 
+				signInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),
+				initSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),
+				activatePasswordlessOtp: this.resolvers.passwordlessMutationResolver.activatePasswordlessOtp.bind(this.resolvers.passwordlessMutationResolver),
+				disableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.disableMyPasswordless.bind(this.resolvers.togglePasswordlessMutationResolver),
+				enableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.enableMyPasswordless.bind(this.resolvers.togglePasswordlessMutationResolver),
+
 				invite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),
 				unmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),
 
@@ -154,6 +171,8 @@ class ResolverFactory {
 
 				addGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(this.resolvers.identityGlobalRolesMutationResolver),
 				removeGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(this.resolvers.identityGlobalRolesMutationResolver),
+
+				configure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),
 			},
 		}
 	}

package/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts

@@ -0,0 +1,29 @@
+import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
+import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions } from '../../../model'
+import { createErrorResponse } from '../../errorUtils'
+
+export class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {
+	constructor(
+		private readonly configurationManager: ConfigurationManager,
+	) {
+	}
+
+	async configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to configure',
+		})
+
+		const result = await this.configurationManager.updateConfiguration(context.db, config)
+
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return {
+			ok: true,
+		}
+	}
+}