@contember/engine-tenant-api 2.0.0-alpha.14 → 2.0.0-alpha.16

package/src/resolvers/mutation/person/PasswordlessMutationResolver.ts

@@ -0,0 +1,81 @@
+import {
+	ActivatePasswordlessOtpResponse,
+	InitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,
+	MutationInitSignInPasswordlessArgs,
+	MutationResolvers,
+	MutationSignInPasswordlessArgs,
+	SignInPasswordlessResponse,
+} from '../../../schema'
+import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions } from '../../../model'
+import { createErrorResponse } from '../../errorUtils'
+import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
+import { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'
+
+export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {
+	constructor(
+		private readonly passwordlessSignInManager: PasswordlessSignInManager,
+		private readonly signInResponseFactory: SignInResponseFactory,
+	) {}
+
+	async initSignInPasswordless(
+		parent: any,
+		args: MutationInitSignInPasswordlessArgs,
+		context: TenantResolverContext,
+	): Promise<InitSignInPasswordlessResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,
+			message: 'You are not allowed to request passwordless sign in',
+		})
+		const result = await this.passwordlessSignInManager.initSignInPasswordless({
+			db: context.db,
+			permissionContext: context.permissionContext,
+			email: args.email,
+			mailVariant: args.options?.mailVariant ?? undefined,
+			mailProject: args.options?.mailProject ?? undefined,
+		})
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+		return { ok: true, result: result.result }
+	}
+
+	async signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+			message: 'You are not allowed to sign in using passwordless',
+		})
+		const signIn = await this.passwordlessSignInManager.signInPasswordless({
+			db: context.db,
+			requestId: args.requestId,
+			token: args.token,
+			mfaOtp: args.mfaOtp ?? undefined,
+			validationType: args.validationType,
+			expiration: args.expiration ?? undefined,
+		})
+		if (!signIn.ok) {
+			return createErrorResponse(signIn.error, signIn.errorMessage)
+		}
+		return {
+			ok: true,
+			result: await this.signInResponseFactory.createResponse(signIn.result, context),
+		}
+	}
+
+	async activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+			message: 'You are not allowed to activate passwordless OTP',
+		})
+		const result = await this.passwordlessSignInManager.activatePasswordlessOtp({
+			db: context.db,
+			requestId: args.requestId,
+			token: args.token,
+			otpHash: args.otpHash,
+		})
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+		return { ok: true }
+	}
+}

package/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts

@@ -1,22 +1,13 @@
 import {
-	CreatePasswordResetRequestErrorCode,
 	CreatePasswordResetRequestResponse,
 	MutationCreateResetPasswordRequestArgs,
 	MutationResetPasswordArgs,
 	MutationResolvers,
-	ResetPasswordErrorCode as SchemaResetPasswordErrorCode,
 	ResetPasswordResponse,
 } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import {
-	PasswordResetManager,
-	PermissionActions,
-	PermissionContextFactory,
-	PersonQuery,
-	ResetPasswordCommandErrorCode,
-	ResetPasswordErrorCode,
-} from '../../../model'
+import { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 
 export class ResetPasswordMutationResolver implements MutationResolvers {

package/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts

@@ -0,0 +1,44 @@
+import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
+import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions, PersonManager, PersonQuery } from '../../../model'
+import { createErrorResponse } from '../../errorUtils'
+
+export class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {
+	constructor(
+		private readonly configurationManager: ConfigurationManager,
+		private readonly personManager: PersonManager,
+	) {
+	}
+
+	async enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {
+		return this.doTogglePasswordless(context, true)
+	}
+
+	async disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {
+		return this.doTogglePasswordless(context, false)
+	}
+
+	private async doTogglePasswordless(
+		context: TenantResolverContext,
+		value: boolean,
+	): Promise<ToggleMyPasswordlessResponse> {
+		const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))
+		if (!person) {
+			return createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')
+		}
+		await context.requireAccess({
+			action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
+			message: 'You are not allowed to enable passwordless',
+		})
+		const config = await this.configurationManager.fetchConfiguration(context.db)
+		if (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {
+			return createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')
+		}
+
+		await this.personManager.togglePasswordless(context.db, person, value)
+
+		return { ok: true }
+	}
+
+}

package/src/resolvers/query/ConfigurationQueryResolver.ts

@@ -0,0 +1,21 @@
+import { Config, QueryResolvers } from '../../schema'
+import { PermissionActions } from '../../model'
+import { TenantResolverContext } from '../TenantResolverContext'
+import { ConfigurationManager } from '../../model/service/ConfigurationManager'
+
+export class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {
+
+	constructor(
+		private readonly configurationManager: ConfigurationManager,
+	) {
+	}
+
+	async configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIG_VIEW,
+			message: 'You are not allowed to view configuration',
+		})
+
+		return await this.configurationManager.fetchConfiguration(context.db)
+	}
+}

package/src/resolvers/responseHelpers/PersonResponseFactory.ts

@@ -8,6 +8,7 @@ export class PersonResponseFactory {
 			otpEnabled: !!personRow.otp_activated_at,
 			email: personRow.email,
 			name: personRow.name,
+			passwordlessEnabled: personRow.passwordless_enabled,
 			identity: {
 				id: personRow.identity_id,
 				projects,

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -48,11 +48,11 @@ export class ProjectTypeResolver implements ProjectResolvers {
 			variables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {
 				switch (variableDef.type) {
 					case Acl.VariableType.entity:
-						return { __typename: 'RoleEntityVariableDefinition', name, entityName: variableDef.entityName }
+						return { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }
 					case Acl.VariableType.predefined:
-						return { __typename: 'RolePredefinedVariableDefinition', name, value: variableDef.value }
+						return { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }
 					case Acl.VariableType.condition:
-						return { __typename: 'RoleConditionVariableDefinition', name }
+						return { __typename: 'RoleConditionVariableDefinition' as const, name }
 				}
 			}),
 		}))