npm - @contember/engine-tenant-api - Versions diffs - 2.0.0-alpha.18 → 2.0.0-alpha.19 - Mend

@contember/engine-tenant-api 2.0.0-alpha.18 → 2.0.0-alpha.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (98) hide show

package/dist/production/src/model/service/idp/providers/FacebookProvider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, ~~IDPClaim~~, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\n\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\~~tclaims~~: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<~~IDPClaim~~> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType \|\| 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAaA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAKM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGE,kBAAA,MAAA,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MACD;AAAA,MACA,yBAAyB;AAAA,QACxB;AAAA,MACD;AAAA,MACA,uCAAuC;AAAA,QACtC;AAAA,MACD;AAAA,MACA,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,MACA,gBAAgB;AAAA,IAChB,CAAA,CAAA;AAEuB,kBAAA,MAAA,yBAAA,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,~~QAAQ~~,cAAc;AAAA,~~MACtB~~,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,~~MAAkC~~;~~AACpG~~,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAE7E,QAAA,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,aAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IAAA,OAC9C;AACA,YAAA,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAO;AACxC,YAAA,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AAChB,cAAA,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AAC3H,YAAA,WAAW,MAAM,MAAM,GAAG;AAC5B,UAAA,CAAC,SAAS,IAAI;AACX,cAAA,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAM,CAAA,EAAE;AAAA,MACtG;AACM,YAAA,UAAU,MAAM,SAAS;AAExB,aAAA;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AACnG,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AAC9E,WAAA,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}
1	+ {"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\n\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType \|\| 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAaA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAKM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGE,kBAAA,MAAA,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MACD;AAAA,MACA,yBAAyB;AAAA,QACxB;AAAA,MACD;AAAA,MACA,uCAAuC;AAAA,QACtC;AAAA,MACD;AAAA,MACA,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,MACA,gBAAgB;AAAA,IAChB,CAAA,CAAA;AAEuB,kBAAA,MAAA,yBAAA,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAE7E,QAAA,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,aAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IAAA,OAC9C;AACA,YAAA,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAO;AACxC,YAAA,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AAChB,cAAA,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AAC3H,YAAA,WAAW,MAAM,MAAM,GAAG;AAC5B,UAAA,CAAC,SAAS,IAAI;AACX,cAAA,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAM,CAAA,EAAE;AAAA,MACtG;AACM,YAAA,UAAU,MAAM,SAAS;AAExB,aAAA;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AACnG,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AAC9E,WAAA,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCHelpers.cjs CHANGED Viewed

@@ -6,13 +6,13 @@ const IDPResponseError = require("../IDPResponseError.cjs");
 openidClient.custom.setHttpOptionsDefaults({
   timeout: 5e3
 });
-const initOIDCAuth = async (client, { redirectUrl, claims, responseMode }) => {
+const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
   const nonce = openidClient.generators.nonce();
   const state = openidClient.generators.state();
   const url = client.authorizationUrl({
     redirect_uri: redirectUrl,
     response_mode: responseMode,
-    scope: claims ?? "openid email",
+    scope: scope ?? "openid email",
     nonce,
     state
   });
@@ -29,10 +29,10 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
   try {
     const result = await client.callback(redirectUrl, params, sessionData);
     const claims = result.claims();
+    const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
     return {
       externalIdentifier: claims.sub,
-      email: claims.email,
-      name: claims.name
+      ...claimsWithoutHashes
     };
   } catch (e) {
     if (e instanceof openidClient.errors.RPError) {

package/dist/production/src/model/service/idp/providers/OIDCHelpers.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { ~~IDPClaim~~, InitIDPAuthResult } from '../IdentityProviderHandler'\n\ncustom.setHttpOptionsDefaults({\n\ttimeout: 5000,\n})\n\nexport const initOIDCAuth = async (client: Client, { redirectUrl, ~~claims~~, responseMode }: { redirectUrl: string; ~~claims~~?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: ~~claims~~ ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<~~IDPClaim~~> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\~~treturn~~ {\n\t\t\~~texternalIdentifier: claims.sub,\~~n\t\t\~~temail~~: claims.~~email~~,\n\t\t\~~tname: claims.name~~,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":["custom","generators","IDPValidationError","errors","IDPResponseError"],"mappings":";;;;;AAMAA,aAAA,OAAO,uBAAuB;AAAA,EAC7B,SAAS;AACV,CAAC;AAEM,MAAM,eAAe,OAAO,QAAgB,EAAE,aAAa,~~QAAQ~~,~~mBAAgH~~;~~AACnL~~,QAAA,QAAQC,wBAAW;AACnB,QAAA,QAAQA,wBAAW;AACnB,QAAA,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,~~UAAU~~;AAAA,~~IACjB~~;AAAA,IACA;AAAA,EAAA,CACA;AAEM,SAAA;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAM;AAAA,EAAA;AAE9B;AAEa,MAAA,qBAAqB,OAAO,QAAgB,EAAE,aAAa,aAAa,GAAG,~~gBAAqD~~;~~AACtI~~,QAAA,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AAClC,UAAA,IAAIC,sCAAmB,6DAA6D;AAAA,EAC3F;AACI,MAAA;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AAC/D,UAAA,SAAS,OAAO;~~AACf~~,WAAA;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,~~OAAO,OAAO~~;AAAA,~~MACd,MAAM,OAAO;AAAA,~~IAAA;AAAA,~~WAEN~~,GAAQ;AACZ,QAAA,aAAaC,oBAAO,SAAS;AAC1B,YAAA,IAAID,mBAAmB,mBAAA,EAAE,OAAO;AAAA,IACvC;AACI,QAAA,aAAaC,oBAAO,SAAS;AAC1B,YAAA,OAAO,EAAE,UAAU;AACrB,UAAA,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACM,YAAA,IAAIA,iBAAiB,iBAAA,EAAE,OAAO;AAAA,IACrC;AACM,UAAA;AAAA,EACP;AACD;;;"}
1	+ {"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\ncustom.setHttpOptionsDefaults({\n\ttimeout: 5000,\n})\n\nexport const initOIDCAuth = async (client: Client, { redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...claimsWithoutHashes,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":["custom","generators","IDPValidationError","errors","IDPResponseError"],"mappings":";;;;;AAMAA,aAAA,OAAO,uBAAuB;AAAA,EAC7B,SAAS;AACV,CAAC;AAEM,MAAM,eAAe,OAAO,QAAgB,EAAE,aAAa,OAAO,mBAA+G;AACjL,QAAA,QAAQC,wBAAW;AACnB,QAAA,QAAQA,wBAAW;AACnB,QAAA,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAEM,SAAA;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAM;AAAA,EAAA;AAE9B;AAEa,MAAA,qBAAqB,OAAO,QAAgB,EAAE,aAAa,aAAa,GAAG,gBAAwD;AACzI,QAAA,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AAClC,UAAA,IAAIC,sCAAmB,6DAA6D;AAAA,EAC3F;AACI,MAAA;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AAC/D,UAAA,SAAS,OAAO;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,oBAAwB,IAAA;AACpD,WAAA;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,IAAA;AAAA,WAEI,GAAQ;AACZ,QAAA,aAAaC,oBAAO,SAAS;AAC1B,YAAA,IAAID,mBAAmB,mBAAA,EAAE,OAAO;AAAA,IACvC;AACI,QAAA,aAAaC,oBAAO,SAAS;AAC1B,YAAA,OAAO,EAAE,UAAU;AACrB,UAAA,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACM,YAAA,IAAIA,iBAAiB,iBAAA,EAAE,OAAO;AAAA,IACrC;AACM,UAAA;AAAA,EACP;AACD;;;"}

package/dist/production/src/model/service/idp/providers/OIDCHelpers.js CHANGED Viewed

@@ -4,13 +4,13 @@ import { IDPResponseError } from "../IDPResponseError.js";
 custom.setHttpOptionsDefaults({
   timeout: 5e3
 });
-const initOIDCAuth = async (client, { redirectUrl, claims, responseMode }) => {
+const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
   const nonce = generators.nonce();
   const state = generators.state();
   const url = client.authorizationUrl({
     redirect_uri: redirectUrl,
     response_mode: responseMode,
-    scope: claims ?? "openid email",
+    scope: scope ?? "openid email",
     nonce,
     state
   });
@@ -27,10 +27,10 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
   try {
     const result = await client.callback(redirectUrl, params, sessionData);
     const claims = result.claims();
+    const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
     return {
       externalIdentifier: claims.sub,
-      email: claims.email,
-      name: claims.name
+      ...claimsWithoutHashes
     };
   } catch (e) {
     if (e instanceof errors.RPError) {

package/dist/production/src/model/service/idp/providers/OIDCHelpers.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { ~~IDPClaim~~, InitIDPAuthResult } from '../IdentityProviderHandler'\n\ncustom.setHttpOptionsDefaults({\n\ttimeout: 5000,\n})\n\nexport const initOIDCAuth = async (client: Client, { redirectUrl, ~~claims~~, responseMode }: { redirectUrl: string; ~~claims~~?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: ~~claims~~ ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<~~IDPClaim~~> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\~~treturn~~ {\n\t\t\~~texternalIdentifier: claims.sub,\~~n\t\t\~~temail~~: claims.~~email~~,\n\t\t\~~tname: claims.name~~,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":[],"mappings":";;;AAMA,OAAO,uBAAuB;AAAA,EAC7B,SAAS;AACV,CAAC;AAEM,MAAM,eAAe,OAAO,QAAgB,EAAE,aAAa,~~QAAQ~~,~~mBAAgH~~;~~AACnL~~,QAAA,QAAQ,WAAW;AACnB,QAAA,QAAQ,WAAW;AACnB,QAAA,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,~~UAAU~~;AAAA,~~IACjB~~;AAAA,IACA;AAAA,EAAA,CACA;AAEM,SAAA;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAM;AAAA,EAAA;AAE9B;AAEa,MAAA,qBAAqB,OAAO,QAAgB,EAAE,aAAa,aAAa,GAAG,~~gBAAqD~~;~~AACtI~~,QAAA,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AAClC,UAAA,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACI,MAAA;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AAC/D,UAAA,SAAS,OAAO;~~AACf~~,WAAA;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,~~OAAO,OAAO~~;AAAA,~~MACd,MAAM,OAAO;AAAA,~~IAAA;AAAA,~~WAEN~~,GAAQ;AACZ,QAAA,aAAa,OAAO,SAAS;AAC1B,YAAA,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACI,QAAA,aAAa,OAAO,SAAS;AAC1B,YAAA,OAAO,EAAE,UAAU;AACrB,UAAA,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACM,YAAA,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACM,UAAA;AAAA,EACP;AACD;"}
1	+ {"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\ncustom.setHttpOptionsDefaults({\n\ttimeout: 5000,\n})\n\nexport const initOIDCAuth = async (client: Client, { redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...claimsWithoutHashes,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":[],"mappings":";;;AAMA,OAAO,uBAAuB;AAAA,EAC7B,SAAS;AACV,CAAC;AAEM,MAAM,eAAe,OAAO,QAAgB,EAAE,aAAa,OAAO,mBAA+G;AACjL,QAAA,QAAQ,WAAW;AACnB,QAAA,QAAQ,WAAW;AACnB,QAAA,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAEM,SAAA;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAM;AAAA,EAAA;AAE9B;AAEa,MAAA,qBAAqB,OAAO,QAAgB,EAAE,aAAa,aAAa,GAAG,gBAAwD;AACzI,QAAA,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AAClC,UAAA,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACI,MAAA;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AAC/D,UAAA,SAAS,OAAO;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,oBAAwB,IAAA;AACpD,WAAA;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,IAAA;AAAA,WAEI,GAAQ;AACZ,QAAA,aAAa,OAAO,SAAS;AAC1B,YAAA,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACI,QAAA,aAAa,OAAO,SAAS;AAC1B,YAAA,OAAO,EAAE,UAAU;AACrB,UAAA,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACM,YAAA,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACM,UAAA;AAAA,EACP;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCProvider.cjs CHANGED Viewed

@@ -18,7 +18,7 @@ class OIDCProvider {
     const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
     const client = await this.createOIDCClient(configuration);
     return await OIDCHelpers.initOIDCAuth(client, {
-      claims: configuration.claims,
+      scope: configuration.scope ?? configuration.claims,
       ...initData
     });
   }

package/dist/production/src/model/service/idp/providers/OIDCProvider.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, ~~IDPClaim~~, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\~~tclaims~~: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<~~IDPClaim~~> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType \|\| 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer"],"mappings":";;;;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAAA,QAAA,cAAcC,6BAAmBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,~~QAAQ~~,cAAc;AAAA,~~MACtB~~,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,~~MAAkC~~;~~AAChG~~,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMG,YAAmB,mBAAA,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;;"}
1	+ {"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType \|\| 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer"],"mappings":";;;;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAAA,QAAA,cAAcC,6BAAmBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMG,YAAmB,mBAAA,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/model/service/idp/providers/OIDCProvider.js CHANGED Viewed

@@ -16,7 +16,7 @@ class OIDCProvider {
     const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
     const client = await this.createOIDCClient(configuration);
     return await initOIDCAuth(client, {
-      claims: configuration.claims,
+      scope: configuration.scope ?? configuration.claims,
       ...initData
     });
   }

package/dist/production/src/model/service/idp/providers/OIDCProvider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, ~~IDPClaim~~, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\~~tclaims~~: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<~~IDPClaim~~> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType \|\| 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAA,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,~~QAAQ~~,cAAc;AAAA,~~MACtB~~,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,~~MAAkC~~;~~AAChG~~,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}
1	+ {"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType \|\| 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAA,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCTypes.cjs CHANGED Viewed

@@ -21,6 +21,8 @@ const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
 const OIDCConfigurationOptions = Typesafe__namespace.partial({
   responseType: Typesafe__namespace.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
   claims: Typesafe__namespace.string,
+  // deprecated, use scope instead
+  scope: Typesafe__namespace.string,
   additionalAuthorizedParties: Typesafe__namespace.array(Typesafe__namespace.string),
   idTokenSignedResponseAlg: Typesafe__namespace.string
 });

package/dist/production/src/model/service/idp/providers/OIDCTypes.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQa,MAAA,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA,EACjB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAC3D,0BAA0BA,oBAAS;AACpC,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACAA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;"}
1	+ {"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string, // deprecated, use scope instead\n\tscope: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQa,MAAA,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA;AAAA,EACjB,OAAOA,oBAAS;AAAA,EAChB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAC3D,0BAA0BA,oBAAS;AACpC,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACAA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;"}

package/dist/production/src/model/service/idp/providers/OIDCTypes.js CHANGED Viewed

@@ -2,6 +2,8 @@ import * as Typesafe from "@contember/typesafe";
 const OIDCConfigurationOptions = Typesafe.partial({
   responseType: Typesafe.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
   claims: Typesafe.string,
+  // deprecated, use scope instead
+  scope: Typesafe.string,
   additionalAuthorizedParties: Typesafe.array(Typesafe.string),
   idTokenSignedResponseAlg: Typesafe.string
 });

package/dist/production/src/model/service/idp/providers/OIDCTypes.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCTypes.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":[],"mappings":";AAQa,MAAA,2BAA2B,SAAS,QAAQ;AAAA,EACxD,cAAc,SAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQ,SAAS;AAAA,EACjB,6BAA6B,SAAS,MAAM,SAAS,MAAM;AAAA,EAC3D,0BAA0B,SAAS;AACpC,CAAC;AACM,MAAM,wBAAwB,SAAS;AAAA,EAC7C,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,IACd,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoB,SAAS;AAAA,EACzC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmB,SAAS;AAAA,EACxC,SAAS;AAAA,IACR,SAAS,OAAO;AAAA,MACf,KAAK,SAAS;AAAA,IAAA,CACd;AAAA,IACD,SAAS,OAAO;AAAA,MACf,YAAY,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACA,SAAS,QAAQ;AAAA,IAChB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS,QAAQ;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,OAAO,SAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAe,SAAS,aAAa,SAAS;AAAA,EAC1D,SAAS,OAAO;AAAA,IACf,aAAa,SAAS;AAAA,EAAA,CACtB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,cAAc,SAAS;AAAA,EAAA,CACvB;AACF,CAAC;"}
1	+ {"version":3,"file":"OIDCTypes.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string, // deprecated, use scope instead\n\tscope: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":[],"mappings":";AAQa,MAAA,2BAA2B,SAAS,QAAQ;AAAA,EACxD,cAAc,SAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQ,SAAS;AAAA;AAAA,EACjB,OAAO,SAAS;AAAA,EAChB,6BAA6B,SAAS,MAAM,SAAS,MAAM;AAAA,EAC3D,0BAA0B,SAAS;AACpC,CAAC;AACM,MAAM,wBAAwB,SAAS;AAAA,EAC7C,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,IACd,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoB,SAAS;AAAA,EACzC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmB,SAAS;AAAA,EACxC,SAAS;AAAA,IACR,SAAS,OAAO;AAAA,MACf,KAAK,SAAS;AAAA,IAAA,CACd;AAAA,IACD,SAAS,OAAO;AAAA,MACf,YAAY,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACA,SAAS,QAAQ;AAAA,IAChB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS,QAAQ;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,OAAO,SAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAe,SAAS,aAAa,SAAS;AAAA,EAC1D,SAAS,OAAO;AAAA,IACf,aAAa,SAAS;AAAA,EAAA,CACtB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,cAAc,SAAS;AAAA,EAAA,CACvB;AACF,CAAC;"}

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.cjs CHANGED Viewed

@@ -58,7 +58,10 @@ class IDPMutationResolver {
     return {
       ok: true,
       errors: [],
-      result: await this.signInResponseFactory.createResponse(signIn.result, context)
+      result: {
+        ...await this.signInResponseFactory.createResponse(signIn.result, context),
+        idpResponse: signIn.result.idpResponse
+      }
     };
   }
 }

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAI,GAAA,QAAQ,OAAO;EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IAAA;AAEhB,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,~~EAEhF~~;AACD;;"}
1	+ {"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAI,GAAA,QAAQ,OAAO;EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IAAA;AAEhB,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAC5B;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.js CHANGED Viewed

@@ -56,7 +56,10 @@ class IDPMutationResolver {
     return {
       ok: true,
       errors: [],
-      result: await this.signInResponseFactory.createResponse(signIn.result, context)
+      result: {
+        ...await this.signInResponseFactory.createResponse(signIn.result, context),
+        idpResponse: signIn.result.idpResponse
+      }
     };
   }
 }

package/dist/production/src/resolvers/mutation/person/IDPMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAI,GAAA,QAAQ,OAAO;EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IAAA;AAEhB,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,~~EAEhF~~;AACD;"}
1	+ {"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAI,GAAA,QAAQ,OAAO;EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IAAA;AAEhB,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACO,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAC5B;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/schema/tenant.graphql.cjs CHANGED Viewed

@@ -390,6 +390,7 @@ const schema = graphqlTag.gql`
 	type SignInIDPResult implements CommonSignInResult {
 		token: String!
 		person: Person!
+		idpResponse: Json
 	}
 	type AddIDPResponse {

package/dist/production/src/schema/tenant.graphql.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tenant.graphql.cjs","sources":["../../../../../packages/engine-tenant-api/src/schema/tenant.graphql.ts"],"sourcesContent":["import { gql } from 'graphql-tag'\nimport { DocumentNode } from 'graphql'\n\nconst schema: DocumentNode = gql`\n\tscalar Json\n\tscalar DateTime\n\n\tschema {\n\t\tquery: Query\n\t\tmutation: Mutation\n\t}\n\n\ttype Query {\n\t\tme: Identity!\n\t\tpersonById(id: String!): Person\n\t\tprojects: [Project!]!\n\t\tprojectBySlug(slug: String!): Project\n\t\tprojectMemberships(projectSlug: String!, identityId: String!): [Membership!]!\n\t\tcheckResetPasswordToken(requestId: String!, token: String!): CheckResetPasswordTokenCode!\n\n\t\tidentityProviders: [IdentityProvider!]!\n\t\tmailTemplates: [MailTemplateData!]!\n\t\t\n\t\tconfiguration: Config!\n\t}\n\n\ttype Mutation {\n\t\tsignUp(email: String!, password: String, passwordHash: String, roles: [String!], name: String): SignUpResponse\n\t\tsignIn(email: String!, password: String!, expiration: Int, otpToken: String): SignInResponse\n\t\tcreateSessionToken(email: String, personId: String, expiration: Int): CreateSessionTokenResponse\n\t\tsignOut(all: Boolean): SignOutResponse\n\t\tchangeProfile(personId: String!, email: String, name: String): ChangeProfileResponse\n\t\tchangeMyProfile(email: String, name: String): ChangeMyProfileResponse\n\t\tchangePassword(personId: String!, password: String!): ChangePasswordResponse\n\t\tchangeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse\n\n\t\tinitSignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\")\n\t\t): InitSignInIDPResponse\n\t\tsignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json,\n\t\t\texpiration: Int\n\t\t\tidpResponse: IDPResponseInput, @deprecated(reason: \"pass idpResponse.url as data.url\")\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\"),\n\t\t\tsessionData: Json @deprecated(reason: \"use data.sessionData\"),\n\t\t): SignInIDPResponse\n\t\t\n\t\t# passwordless sign in\n\t\tinitSignInPasswordless(email: String!, options: InitSignInPasswordlessOptions): InitSignInPasswordlessResponse\n\t\tsignInPasswordless(requestId: String!, validationType: PasswordlessValidationType!, token: String!, expiration: Int, mfaOtp: String): SignInPasswordlessResponse\n\t\tactivatePasswordlessOtp(requestId: String!, token: String!, otpHash: String!): ActivatePasswordlessOtpResponse\n\n enableMyPasswordless: ToggleMyPasswordlessResponse\n disableMyPasswordless: ToggleMyPasswordlessResponse\n\n\t\t# IDP management\n\t\taddIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse\n\t\tupdateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions, mergeConfiguration: Boolean): UpdateIDPResponse\n\t\tdisableIDP(identityProvider: String!): DisableIDPResponse\n\t\tenableIDP(identityProvider: String!): EnableIDPResponse\n\n\t\tprepareOtp(label: String): PrepareOtpResponse\n\t\tconfirmOtp(otpToken: String!): ConfirmOtpResponse\n\t\tdisableOtp: DisableOtpResponse\n\n\t\tdisablePerson(personId: String!): DisablePersonResponse\n\n\t\tcreateResetPasswordRequest(email: String!, options: CreateResetPasswordRequestOptions): CreatePasswordResetRequestResponse\n\t\tresetPassword(token: String!, password: String!): ResetPasswordResponse\n\n\t\tinvite(email: String!, name: String, projectSlug: String!, memberships: [MembershipInput!]!, options: InviteOptions): InviteResponse\n\t\tunmanagedInvite(\n\t\t\temail: String!,\n\t\t\tname: String,\n\t\t\tprojectSlug: String!,\n\t\t\tmemberships: [MembershipInput!]!,\n\t\t\toptions: UnmanagedInviteOptions,\n\t\t\tpassword: String @deprecated(reason: \"Use options\")\n\t\t): InviteResponse\n\n\t\taddProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): AddProjectMemberResponse\n\t\tremoveProjectMember(projectSlug: String!, identityId: String!): RemoveProjectMemberResponse\n\n\t\tupdateProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): UpdateProjectMemberResponse\n\n\t\tcreateApiKey(projectSlug: String!, memberships: [MembershipInput!]!, description: String!, tokenHash: String): CreateApiKeyResponse\n\t\tcreateGlobalApiKey(description: String!, roles: [String!], tokenHash: String): CreateApiKeyResponse\n\t\tdisableApiKey(id: String!): DisableApiKeyResponse\n\t\taddGlobalIdentityRoles(identityId: String!, roles: [String!]!): AddGlobalIdentityRolesResponse\n\t\tremoveGlobalIdentityRoles(identityId: String!, roles: [String!]!): RemoveGlobalIdentityRolesResponse\n\n\t\taddMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\tremoveMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\n\t\tcreateProject(\n\t\t\tprojectSlug: String!,\n\t\t\tname: String,\n\t\t\tconfig: Json,\n\t\t\tsecrets: [ProjectSecret!],\n\t\t\toptions: CreateProjectOptions,\n\t\t\tdeployTokenHash: String @deprecated(reason: \"Use options\")\n\t\t): CreateProjectResponse\n\t\tsetProjectSecret(projectSlug: String!, key: String!, value: String!): SetProjectSecretResponse\n\t\tupdateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse\n\t\t\n\t\tconfigure(config: ConfigInput!): ConfigureResponse\n\n\t\taddProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\t@deprecated(reason: \"use addMailTemplate\")\n\n\t\tremoveProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\t\t@deprecated(reason: \"use removeMailTemplate\")\n\n\t}\n\t\n\t# === configure ===\n\t\n\ttype Config {\n\t\tpasswordless: ConfigPasswordless!\n\t}\n\t\n\ttype ConfigPasswordless {\n\t\tenabled: ConfigPolicy!\n\t\turl: String\n\t\texpirationMinutes: Int!\n\t}\n\t\n\tinput ConfigInput {\n\t\tpasswordless: ConfigPasswordlessInput\n\t}\n\t\n\tenum ConfigPolicy {\n\t\talways\n\t\tnever\n\t\toptIn\n\t\toptOut\n\t}\n\t\n\tinput ConfigPasswordlessInput {\n\t\tenabled: ConfigPolicy\n\t\turl: String\n\t\texpirationMinutes: Int\n\t}\n\t\n\ttype ConfigureResponse {\n\t\tok: Boolean!\n\t\terror: ConfigureError\n\t}\n\t\n\ttype ConfigureError {\n\t\tcode: ConfigureErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ConfigureErrorCode {\n\t\tINVALID_CONFIG\n\t}\n\n\t# === signUp ===\n\ttype SignUpResponse {\n\t\tok: Boolean!\n\t\terrors: [SignUpError!]! @deprecated\n\t\terror: SignUpError\n\t\tresult: SignUpResult\n\t}\n\n\ttype SignUpError {\n\t\tcode: SignUpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendPersonMessage: String @deprecated\n\t}\n\n\tenum SignUpErrorCode {\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t\tTOO_WEAK\n\t}\n\n\ttype SignUpResult {\n\t\tperson: Person!\n\t}\n\n\t# === signInCommon ==\n\n\tinterface CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signIn ===\n\ttype SignInResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInError!]! @deprecated\n\t\terror: SignInError\n\t\tresult: SignInResult\n\t}\n\n\ttype SignInError {\n\t\tcode: SignInErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tINVALID_PASSWORD\n\t\tPERSON_DISABLED\n\t\tNO_PASSWORD_SET\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\n\ttype SignInResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# == createSessionToken ==\n\n\ttype CreateSessionTokenResponse {\n\t\tok: Boolean!\n\t\terror: CreateSessionTokenError\n\t\tresult: CreateSessionTokenResult\n\t}\n\n\ttype CreateSessionTokenError {\n\t\tcode: CreateSessionTokenErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateSessionTokenErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tUNKNOWN_PERSON_ID\n\t\tPERSON_DISABLED\n\t}\n\n\ttype CreateSessionTokenResult implements CommonSignInResult{\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signOut ===\n\n\ttype SignOutResponse {\n\t\tok: Boolean!\n\t\terrors: [SignOutError!]! @deprecated\n\t\terror: SignOutError\n\t}\n\n\ttype SignOutError {\n\t\tcode: SignOutErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignOutErrorCode {\n\t\tNOT_A_PERSON,\n\t\tNOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY\n\t}\n\n\t# === changeProfile ===\n\t\n\ttype ChangeProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeProfileError\n\t}\n\t\n\ttype ChangeProfileError {\n\t\tcode: ChangeProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ChangeProfileErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\n\t\n\t# === changeMyProfile ===\n\n\ttype ChangeMyProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyProfileError\n\t}\n\n\ttype ChangeMyProfileError {\n\t\tcode: ChangeMyProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyProfileErrorCode {\n\t\tNOT_A_PERSON\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\t\n\n\t# === changePassword ===\n\n\ttype ChangePasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ChangePasswordError!]! @deprecated\n\t\terror: ChangePasswordError\n\t}\n\n\ttype ChangePasswordError {\n\t\tcode: ChangePasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ChangePasswordErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tTOO_WEAK\n\t}\n\n\n\t# === changeMyPassword ===\n\t\n\ttype ChangeMyPasswordResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyPasswordError\n\t}\n\n\ttype ChangeMyPasswordError {\n\t\tcode: ChangeMyPasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyPasswordErrorCode {\n\t\tTOO_WEAK\n\t\tNOT_A_PERSON\n\t\tINVALID_PASSWORD\n\t\tNO_PASSWORD_SET\n\t}\n\n\t# === IDP ===\n\n\ttype InitSignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [InitSignInIDPError!]! @deprecated\n\t\terror: InitSignInIDPError\n\t\tresult: InitSignInIDPResult\n\t}\n\n\ttype InitSignInIDPResult {\n\t\tauthUrl: String!\n\t\tsessionData: Json!\n\t\tidpConfiguration: Json\n\t}\n\n\ttype InitSignInIDPError {\n\t\tcode: InitSignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InitSignInIDPErrorCode {\n\t\tPROVIDER_NOT_FOUND\n\t\tIDP_VALIDATION_FAILED\n\t}\n\n\tinput IDPResponseInput {\n\t\turl: String!\n\t}\n\n\ttype SignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInIDPError!]! @deprecated\n\t\terror: SignInIDPError\n\t\tresult: SignInIDPResult\n\t}\n\n\ttype SignInIDPError {\n\t\tcode: SignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInIDPErrorCode {\n\t\tINVALID_IDP_RESPONSE\n\t\tIDP_VALIDATION_FAILED\n\n\t\tPERSON_NOT_FOUND\n\t\tPERSON_DISABLED\n\t\tPERSON_ALREADY_EXISTS\n\t}\n\n\ttype SignInIDPResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\ttype AddIDPResponse {\n\t\terror: AddIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype AddIDPError {\n\t\tcode: AddIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddIDPErrorCode {\n\t\tALREADY_EXISTS\n\t\tUNKNOWN_TYPE\n\t\tINVALID_CONFIGURATION\n\t}\n\n\ttype UpdateIDPResponse {\n\t\terror: UpdateIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype UpdateIDPError {\n\t\tcode: UpdateIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateIDPErrorCode {\n\t\tNOT_FOUND\n\t\tINVALID_CONFIGURATION\n\t}\n\n\n\ttype DisableIDPResponse {\n\t\terror: DisableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisableIDPError {\n\t\tcode: DisableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype EnableIDPResponse {\n\t\terror: EnableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype EnableIDPError {\n\t\tcode: EnableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype IdentityProvider {\n\t\tslug: String!\n\t\ttype: String!\n\t\tconfiguration: Json!\n\t\tdisabledAt: DateTime\n\t\toptions: IDPOptionsOutput!\n\t}\n\n\ttype IDPOptionsOutput {\n\t\tautoSignUp: Boolean!\n\t\texclusive: Boolean!\n\t\tinitReturnsConfig: Boolean!\n\t}\n\n\tinput IDPOptions {\n\t\tautoSignUp: Boolean\n\t\texclusive: Boolean\n\t\tinitReturnsConfig: Boolean\n\t}\n\n\t# === passwordless sign in ===\n\t\n\ttype InitSignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: InitSignInPasswordlessError\n\t\tresult: InitSignInPasswordlessResult\n\t}\n\t\n\ttype InitSignInPasswordlessError {\n\t\tcode: InitSignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum InitSignInPasswordlessErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\t\n\t\tPASSWORDLESS_DISABLED\n\t}\n\t\n\ttype InitSignInPasswordlessResult {\n\t\trequestId: String!\n\t\texpiresAt: DateTime!\n\t}\n\n\tinput InitSignInPasswordlessOptions {\n\t\tmailVariant: String\n\t\tmailProject: String\n\t}\n\t\n\ttype SignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: SignInPasswordlessError\n\t\tresult: SignInPasswordlessResult\n\t}\n\t\n\tenum PasswordlessValidationType {\n\t\totp\n\t\ttoken\n\t}\n\t\n\ttype SignInPasswordlessError {\n\t\tcode: SignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum SignInPasswordlessErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t\tPERSON_DISABLED\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\t\n\ttype SignInPasswordlessResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\t\n\ttype ActivatePasswordlessOtpResponse {\n\t\tok: Boolean!\n\t\terror: ActivatePasswordlessOtpError\n\t}\n\t\n\ttype ActivatePasswordlessOtpError {\n\t\tcode: ActivatePasswordlessOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ActivatePasswordlessOtpErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t}\n\t\n\ttype ToggleMyPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: ToggleMyPasswordlessError\n\t}\n\t\n\ttype ToggleMyPasswordlessError {\n\t\tcode: ToggleMyPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ToggleMyPasswordlessErrorCode {\n\t\tCANNOT_TOGGLE\n NOT_A_PERSON\n\t}\n\t\n\n\t# === invite ===\n\n\ttype InviteResponse {\n\t\tok: Boolean!\n\t\terrors: [InviteError!]! @deprecated\n\t\terror: InviteError\n\t\tresult: InviteResult\n\t}\n\n\ttype InviteError {\n\t\tcode: InviteErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InviteErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\t\tINVALID_EMAIL_FORMAT\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype InviteResult {\n\t\tperson: Person!\n\t\tisNew: Boolean!\n\t}\n\n\tenum InviteMethod {\n\t\tCREATE_PASSWORD\n\t\tRESET_PASSWORD\n\t}\n\n\tinput InviteOptions {\n\t\tmethod: InviteMethod\n\t\tmailVariant: String\n\t}\n\n\tinput UnmanagedInviteOptions {\n\t\tpassword: String\n\t\tresetTokenHash: String\n\t}\n\n\t# === addProjectMember ===\n\n\ttype AddProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [AddProjectMemberError!]!\n\t\terror: AddProjectMemberError\n\t}\n\n\ttype AddProjectMemberError {\n\t\tcode: AddProjectMemberErrorCode!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tIDENTITY_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === updateProjectMember ===\n\n\ttype UpdateProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [UpdateProjectMemberError!]! @deprecated\n\t\terror: UpdateProjectMemberError\n\t}\n\n\ttype UpdateProjectMemberError {\n\t\tcode: UpdateProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum UpdateProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tNOT_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === removeProjectMember ===\n\n\ttype RemoveProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveProjectMemberError!]!\n\t\terror: RemoveProjectMemberError\n\t}\n\n\ttype RemoveProjectMemberError {\n\t\tcode: RemoveProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveProjectMemberErrorCode {\n\t\tNOT_MEMBER\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === createApiKey ===\n\n\ttype CreateApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [CreateApiKeyError!]! @deprecated\n\t\terror: CreateApiKeyError\n\t\tresult: CreateApiKeyResult\n\t}\n\n\ttype CreateApiKeyError {\n\t\tcode: CreateApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreateApiKeyErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_MEMBERSHIP\n\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype CreateApiKeyResult {\n\t\tapiKey: ApiKeyWithToken!\n\t}\n\n\t# === disableApiKey ===\n\n\ttype DisableApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableApiKeyError!]! @deprecated\n\t\terror: DisableApiKeyError\n\t}\n\n\ttype DisableApiKeyError {\n\t\tcode: DisableApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableApiKeyErrorCode {\n\t\tKEY_NOT_FOUND\n\t}\n\t# === addGlobalIdentityRoles ===\n\n\ttype AddGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: AddGlobalIdentityRolesError\n\t\tresult: AddGlobalIdentityRolesResult\n\t}\n\n\ttype AddGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\ttype AddGlobalIdentityRolesError {\n\t\tcode: AddGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\n\n\t# === removeGlobalIdentityRoles ===\n\n\ttype RemoveGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: RemoveGlobalIdentityRolesError\n\t\tresult: RemoveGlobalIdentityRolesResult\n\t}\n\n\ttype RemoveGlobalIdentityRolesError {\n\t\tcode: RemoveGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype RemoveGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\n\tenum RemoveGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\t# === common ===\n\n\t# === variables ===\n\n\tinput VariableEntryInput {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\ttype VariableEntry {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\t# === membership ===\n\n\tinput MembershipInput {\n\t\trole: String!\n\t\tvariables: [VariableEntryInput!]!\n\t}\n\n\ttype Membership {\n\t\trole: String!\n\t\tvariables: [VariableEntry!]!\n\t}\n\n\ttype MembershipValidationError {\n\t\tcode: MembershipValidationErrorCode!\n\t\trole: String!\n\t\tvariable: String\n\t}\n\n\tenum MembershipValidationErrorCode {\n\t\tROLE_NOT_FOUND\n\t\tVARIABLE_NOT_FOUND\n\t\tVARIABLE_EMPTY\n\t\tVARIABLE_INVALID\n\t}\n\n\t# === person ====\n\n\ttype Person {\n\t\tid: String!\n\t\temail: String\n\t\tname: String\n\t\totpEnabled: Boolean!\n\t\tpasswordlessEnabled: Boolean\n\t\tidentity: Identity!\n\t}\n\n\t# === api key ===\n\n\ttype ApiKey {\n\t\tid: String!\n\t\tidentity: Identity!\n\t}\n\n\ttype ApiKeyWithToken {\n\t\tid: String!\n\t\ttoken: String\n\t\tidentity: Identity!\n\t}\n\n\t# === identity ===\n\n\ttype Identity {\n\t\tid: String!\n\t\tdescription: String\n\t\tperson: Person\n\t\tapiKey: ApiKey\n\t\tprojects: [IdentityProjectRelation!]!\n\t\tpermissions: IdentityGlobalPermissions\n\t\troles: [String!]\n\t}\n\n\ttype IdentityGlobalPermissions {\n\t\tcanCreateProject: Boolean!\n\t\tcanDeployEntrypoint: Boolean!\n\t}\n\n\ttype IdentityProjectRelation {\n\t\tproject: Project!\n\t\tmemberships: [Membership!]!\n\t}\n\n\t# === project ===\n\n\ttype Project {\n\t\tid: String!\n\t\tname: String!\n\t\tslug: String!\n\t\tconfig: Json!\n\t\troles: [RoleDefinition!]!\n\t\tmembers(\n\t\t\tinput: ProjectMembersInput,\n\t\t\tmemberType: MemberType @deprecated(reason: \"Use args\")\n\t\t): [ProjectIdentityRelation!]!\n\t}\n\n\tinput ProjectMembersInput {\n\t\tlimit: Int\n\t\toffset: Int\n\t\tfilter: ProjectMembersFilter\n\t}\n\n\tinput ProjectMembersFilter {\n\t\tmemberType: MemberType\n\t\temail: [String!]\n\t\tidentityId: [String!]\n\t\tpersonId: [String!]\n\t}\n\n\tenum MemberType {\n\t\tAPI_KEY\n\t\tPERSON\n\t}\n\n\ttype ProjectIdentityRelation {\n\t\tidentity: Identity!\n\t\tmemberships: [Membership!]!\n\t}\n\n\ttype RoleDefinition {\n\t\tname: String!\n\t\tvariables: [RoleVariableDefinition!]!\n\t}\n\n\tinterface RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\ttype RoleEntityVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tentityName: String!\n\t}\n\n\ttype RolePredefinedVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tvalue: String!\n\t}\n\n\ttype RoleConditionVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\t# ==== 2fa ====\n\n\ttype PrepareOtpResponse {\n\t\tok: Boolean!\n\t\tresult: PrepareOtpResult\n\t}\n\n\ttype PrepareOtpResult {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\ttype ConfirmOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [ConfirmOtpError!]! @deprecated\n\t\terror: ConfirmOtpError\n\t}\n\n\ttype ConfirmOtpError {\n\t\tcode: ConfirmOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ConfirmOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t\tNOT_PREPARED\n\t}\n\n\ttype DisableOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableOtpError!]! @deprecated\n\t\terror: DisableOtpError\n\t}\n\n\ttype DisableOtpError {\n\t\tcode: DisableOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableOtpErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t}\n\n\ttype DisablePersonResponse {\n\t\tok: Boolean!\n\t\terror: DisablePersonError\n\t}\n\n\ttype DisablePersonError {\n\t\tcode: DisablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisablePersonErrorCode {\n\t\tPERSON_ALREADY_DISABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === mails ===\n\t\n\ttype MailTemplateData {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean!\n\t\treplyTo: String\n\t}\n\t\n\tinput MailTemplate {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\t\"Custom mail variant identifier, e.g. a locale.\"\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean\n\t\treplyTo: String\n\t}\n\n\tenum MailType {\n\t\tEXISTING_USER_INVITED\n\t\tNEW_USER_INVITED\n\t\tRESET_PASSWORD_REQUEST\n\t\tPASSWORDLESS_SIGN_IN\n\t}\n\n\tinput MailTemplateIdentifier {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t}\n\n\ttype AddMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [AddMailTemplateError!]! @deprecated\n\t\terror: AddMailTemplateError\n\t}\n\n\ttype AddMailTemplateError {\n\t\tcode: AddMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddMailTemplateErrorCode {\n\t\tMISSING_VARIABLE\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_REPLY_EMAIL_FORMAT\n\t}\n\n\ttype RemoveMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveMailTemplateError!]!\n\t\terror: RemoveMailTemplateError\n\t}\n\n\ttype RemoveMailTemplateError {\n\t\tcode: RemoveMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveMailTemplateErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tTEMPLATE_NOT_FOUND\n\t}\n\n\t# === password reset ===\n\n\ttype CheckResetPasswordTokenResult {\n\t\tcode: CheckResetPasswordTokenCode!\n\t}\n\n\tenum CheckResetPasswordTokenCode {\n\t\tREQUEST_NOT_FOUND\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype CreatePasswordResetRequestResponse {\n\t\tok: Boolean!\n\t\terrors: [CreatePasswordResetRequestError!]! @deprecated\n\t\terror: CreatePasswordResetRequestError\n\t}\n\n\ttype CreatePasswordResetRequestError {\n\t\tcode: CreatePasswordResetRequestErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreatePasswordResetRequestErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\ttype ResetPasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ResetPasswordError!]! @deprecated\n\t\terror: ResetPasswordError\n\t}\n\ttype ResetPasswordError {\n\t\tcode: ResetPasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ResetPasswordErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\n\t\tPASSWORD_TOO_WEAK\n\t}\n\n\tinput CreateResetPasswordRequestOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\t# === project ===\n\n\tinput ProjectSecret {\n\t\tkey: String!\n\t\tvalue: String!\n\t}\n\n\tinput CreateProjectOptions {\n\t\tdeployTokenHash: String\n\t\tnoDeployToken: Boolean\n\t}\n\n\ttype CreateProjectResponse {\n\t\tok: Boolean!\n\t\terror: CreateProjectResponseError\n\t\tresult: CreateProjectResult\n\t}\n\n\ttype CreateProjectResponseError {\n\t\tcode: CreateProjectResponseErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype CreateProjectResult {\n\t\tdeployerApiKey: ApiKeyWithToken\n\t}\n\n\tenum CreateProjectResponseErrorCode {\n\t\tALREADY_EXISTS\n\t\tINIT_ERROR\n\t}\n\n\ttype SetProjectSecretResponse {\n\t\tok: Boolean!\n\t\terror: SetProjectSecretError\n\t}\n\n\ttype SetProjectSecretError {\n\t\tcode: SetProjectSecretErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum SetProjectSecretErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateProjectResponse {\n\t\tok: Boolean!\n\t\terror: UpdateProjectError\n\t}\n\n\ttype UpdateProjectError {\n\t\tcode: UpdateProjectErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateProjectErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n`\n\nexport default schema\n"],"names":["gql"],"mappings":";;AAGA,MAAM,SAAuBA,WAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;;"}
1	+ {"version":3,"file":"tenant.graphql.cjs","sources":["../../../../../packages/engine-tenant-api/src/schema/tenant.graphql.ts"],"sourcesContent":["import { gql } from 'graphql-tag'\nimport { DocumentNode } from 'graphql'\n\nconst schema: DocumentNode = gql`\n\tscalar Json\n\tscalar DateTime\n\n\tschema {\n\t\tquery: Query\n\t\tmutation: Mutation\n\t}\n\n\ttype Query {\n\t\tme: Identity!\n\t\tpersonById(id: String!): Person\n\t\tprojects: [Project!]!\n\t\tprojectBySlug(slug: String!): Project\n\t\tprojectMemberships(projectSlug: String!, identityId: String!): [Membership!]!\n\t\tcheckResetPasswordToken(requestId: String!, token: String!): CheckResetPasswordTokenCode!\n\n\t\tidentityProviders: [IdentityProvider!]!\n\t\tmailTemplates: [MailTemplateData!]!\n\t\t\n\t\tconfiguration: Config!\n\t}\n\n\ttype Mutation {\n\t\tsignUp(email: String!, password: String, passwordHash: String, roles: [String!], name: String): SignUpResponse\n\t\tsignIn(email: String!, password: String!, expiration: Int, otpToken: String): SignInResponse\n\t\tcreateSessionToken(email: String, personId: String, expiration: Int): CreateSessionTokenResponse\n\t\tsignOut(all: Boolean): SignOutResponse\n\t\tchangeProfile(personId: String!, email: String, name: String): ChangeProfileResponse\n\t\tchangeMyProfile(email: String, name: String): ChangeMyProfileResponse\n\t\tchangePassword(personId: String!, password: String!): ChangePasswordResponse\n\t\tchangeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse\n\n\t\tinitSignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\")\n\t\t): InitSignInIDPResponse\n\t\tsignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json,\n\t\t\texpiration: Int\n\t\t\tidpResponse: IDPResponseInput, @deprecated(reason: \"pass idpResponse.url as data.url\")\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\"),\n\t\t\tsessionData: Json @deprecated(reason: \"use data.sessionData\"),\n\t\t): SignInIDPResponse\n\t\t\n\t\t# passwordless sign in\n\t\tinitSignInPasswordless(email: String!, options: InitSignInPasswordlessOptions): InitSignInPasswordlessResponse\n\t\tsignInPasswordless(requestId: String!, validationType: PasswordlessValidationType!, token: String!, expiration: Int, mfaOtp: String): SignInPasswordlessResponse\n\t\tactivatePasswordlessOtp(requestId: String!, token: String!, otpHash: String!): ActivatePasswordlessOtpResponse\n\n enableMyPasswordless: ToggleMyPasswordlessResponse\n disableMyPasswordless: ToggleMyPasswordlessResponse\n\n\t\t# IDP management\n\t\taddIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse\n\t\tupdateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions, mergeConfiguration: Boolean): UpdateIDPResponse\n\t\tdisableIDP(identityProvider: String!): DisableIDPResponse\n\t\tenableIDP(identityProvider: String!): EnableIDPResponse\n\n\t\tprepareOtp(label: String): PrepareOtpResponse\n\t\tconfirmOtp(otpToken: String!): ConfirmOtpResponse\n\t\tdisableOtp: DisableOtpResponse\n\n\t\tdisablePerson(personId: String!): DisablePersonResponse\n\n\t\tcreateResetPasswordRequest(email: String!, options: CreateResetPasswordRequestOptions): CreatePasswordResetRequestResponse\n\t\tresetPassword(token: String!, password: String!): ResetPasswordResponse\n\n\t\tinvite(email: String!, name: String, projectSlug: String!, memberships: [MembershipInput!]!, options: InviteOptions): InviteResponse\n\t\tunmanagedInvite(\n\t\t\temail: String!,\n\t\t\tname: String,\n\t\t\tprojectSlug: String!,\n\t\t\tmemberships: [MembershipInput!]!,\n\t\t\toptions: UnmanagedInviteOptions,\n\t\t\tpassword: String @deprecated(reason: \"Use options\")\n\t\t): InviteResponse\n\n\t\taddProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): AddProjectMemberResponse\n\t\tremoveProjectMember(projectSlug: String!, identityId: String!): RemoveProjectMemberResponse\n\n\t\tupdateProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): UpdateProjectMemberResponse\n\n\t\tcreateApiKey(projectSlug: String!, memberships: [MembershipInput!]!, description: String!, tokenHash: String): CreateApiKeyResponse\n\t\tcreateGlobalApiKey(description: String!, roles: [String!], tokenHash: String): CreateApiKeyResponse\n\t\tdisableApiKey(id: String!): DisableApiKeyResponse\n\t\taddGlobalIdentityRoles(identityId: String!, roles: [String!]!): AddGlobalIdentityRolesResponse\n\t\tremoveGlobalIdentityRoles(identityId: String!, roles: [String!]!): RemoveGlobalIdentityRolesResponse\n\n\t\taddMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\tremoveMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\n\t\tcreateProject(\n\t\t\tprojectSlug: String!,\n\t\t\tname: String,\n\t\t\tconfig: Json,\n\t\t\tsecrets: [ProjectSecret!],\n\t\t\toptions: CreateProjectOptions,\n\t\t\tdeployTokenHash: String @deprecated(reason: \"Use options\")\n\t\t): CreateProjectResponse\n\t\tsetProjectSecret(projectSlug: String!, key: String!, value: String!): SetProjectSecretResponse\n\t\tupdateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse\n\t\t\n\t\tconfigure(config: ConfigInput!): ConfigureResponse\n\n\t\taddProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\t@deprecated(reason: \"use addMailTemplate\")\n\n\t\tremoveProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\t\t@deprecated(reason: \"use removeMailTemplate\")\n\n\t}\n\t\n\t# === configure ===\n\t\n\ttype Config {\n\t\tpasswordless: ConfigPasswordless!\n\t}\n\t\n\ttype ConfigPasswordless {\n\t\tenabled: ConfigPolicy!\n\t\turl: String\n\t\texpirationMinutes: Int!\n\t}\n\t\n\tinput ConfigInput {\n\t\tpasswordless: ConfigPasswordlessInput\n\t}\n\t\n\tenum ConfigPolicy {\n\t\talways\n\t\tnever\n\t\toptIn\n\t\toptOut\n\t}\n\t\n\tinput ConfigPasswordlessInput {\n\t\tenabled: ConfigPolicy\n\t\turl: String\n\t\texpirationMinutes: Int\n\t}\n\t\n\ttype ConfigureResponse {\n\t\tok: Boolean!\n\t\terror: ConfigureError\n\t}\n\t\n\ttype ConfigureError {\n\t\tcode: ConfigureErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ConfigureErrorCode {\n\t\tINVALID_CONFIG\n\t}\n\n\t# === signUp ===\n\ttype SignUpResponse {\n\t\tok: Boolean!\n\t\terrors: [SignUpError!]! @deprecated\n\t\terror: SignUpError\n\t\tresult: SignUpResult\n\t}\n\n\ttype SignUpError {\n\t\tcode: SignUpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendPersonMessage: String @deprecated\n\t}\n\n\tenum SignUpErrorCode {\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t\tTOO_WEAK\n\t}\n\n\ttype SignUpResult {\n\t\tperson: Person!\n\t}\n\n\t# === signInCommon ==\n\n\tinterface CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signIn ===\n\ttype SignInResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInError!]! @deprecated\n\t\terror: SignInError\n\t\tresult: SignInResult\n\t}\n\n\ttype SignInError {\n\t\tcode: SignInErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tINVALID_PASSWORD\n\t\tPERSON_DISABLED\n\t\tNO_PASSWORD_SET\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\n\ttype SignInResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# == createSessionToken ==\n\n\ttype CreateSessionTokenResponse {\n\t\tok: Boolean!\n\t\terror: CreateSessionTokenError\n\t\tresult: CreateSessionTokenResult\n\t}\n\n\ttype CreateSessionTokenError {\n\t\tcode: CreateSessionTokenErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateSessionTokenErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tUNKNOWN_PERSON_ID\n\t\tPERSON_DISABLED\n\t}\n\n\ttype CreateSessionTokenResult implements CommonSignInResult{\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signOut ===\n\n\ttype SignOutResponse {\n\t\tok: Boolean!\n\t\terrors: [SignOutError!]! @deprecated\n\t\terror: SignOutError\n\t}\n\n\ttype SignOutError {\n\t\tcode: SignOutErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignOutErrorCode {\n\t\tNOT_A_PERSON,\n\t\tNOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY\n\t}\n\n\t# === changeProfile ===\n\t\n\ttype ChangeProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeProfileError\n\t}\n\t\n\ttype ChangeProfileError {\n\t\tcode: ChangeProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ChangeProfileErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\n\t\n\t# === changeMyProfile ===\n\n\ttype ChangeMyProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyProfileError\n\t}\n\n\ttype ChangeMyProfileError {\n\t\tcode: ChangeMyProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyProfileErrorCode {\n\t\tNOT_A_PERSON\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\t\n\n\t# === changePassword ===\n\n\ttype ChangePasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ChangePasswordError!]! @deprecated\n\t\terror: ChangePasswordError\n\t}\n\n\ttype ChangePasswordError {\n\t\tcode: ChangePasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ChangePasswordErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tTOO_WEAK\n\t}\n\n\n\t# === changeMyPassword ===\n\t\n\ttype ChangeMyPasswordResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyPasswordError\n\t}\n\n\ttype ChangeMyPasswordError {\n\t\tcode: ChangeMyPasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyPasswordErrorCode {\n\t\tTOO_WEAK\n\t\tNOT_A_PERSON\n\t\tINVALID_PASSWORD\n\t\tNO_PASSWORD_SET\n\t}\n\n\t# === IDP ===\n\n\ttype InitSignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [InitSignInIDPError!]! @deprecated\n\t\terror: InitSignInIDPError\n\t\tresult: InitSignInIDPResult\n\t}\n\n\ttype InitSignInIDPResult {\n\t\tauthUrl: String!\n\t\tsessionData: Json!\n\t\tidpConfiguration: Json\n\t}\n\n\ttype InitSignInIDPError {\n\t\tcode: InitSignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InitSignInIDPErrorCode {\n\t\tPROVIDER_NOT_FOUND\n\t\tIDP_VALIDATION_FAILED\n\t}\n\n\tinput IDPResponseInput {\n\t\turl: String!\n\t}\n\n\ttype SignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInIDPError!]! @deprecated\n\t\terror: SignInIDPError\n\t\tresult: SignInIDPResult\n\t}\n\n\ttype SignInIDPError {\n\t\tcode: SignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInIDPErrorCode {\n\t\tINVALID_IDP_RESPONSE\n\t\tIDP_VALIDATION_FAILED\n\n\t\tPERSON_NOT_FOUND\n\t\tPERSON_DISABLED\n\t\tPERSON_ALREADY_EXISTS\n\t}\n\n\ttype SignInIDPResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\tidpResponse: Json\n\t}\n\n\ttype AddIDPResponse {\n\t\terror: AddIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype AddIDPError {\n\t\tcode: AddIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddIDPErrorCode {\n\t\tALREADY_EXISTS\n\t\tUNKNOWN_TYPE\n\t\tINVALID_CONFIGURATION\n\t}\n\n\ttype UpdateIDPResponse {\n\t\terror: UpdateIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype UpdateIDPError {\n\t\tcode: UpdateIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateIDPErrorCode {\n\t\tNOT_FOUND\n\t\tINVALID_CONFIGURATION\n\t}\n\n\n\ttype DisableIDPResponse {\n\t\terror: DisableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisableIDPError {\n\t\tcode: DisableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype EnableIDPResponse {\n\t\terror: EnableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype EnableIDPError {\n\t\tcode: EnableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype IdentityProvider {\n\t\tslug: String!\n\t\ttype: String!\n\t\tconfiguration: Json!\n\t\tdisabledAt: DateTime\n\t\toptions: IDPOptionsOutput!\n\t}\n\n\ttype IDPOptionsOutput {\n\t\tautoSignUp: Boolean!\n\t\texclusive: Boolean!\n\t\tinitReturnsConfig: Boolean!\n\t}\n\n\tinput IDPOptions {\n\t\tautoSignUp: Boolean\n\t\texclusive: Boolean\n\t\tinitReturnsConfig: Boolean\n\t}\n\n\t# === passwordless sign in ===\n\t\n\ttype InitSignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: InitSignInPasswordlessError\n\t\tresult: InitSignInPasswordlessResult\n\t}\n\t\n\ttype InitSignInPasswordlessError {\n\t\tcode: InitSignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum InitSignInPasswordlessErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\t\n\t\tPASSWORDLESS_DISABLED\n\t}\n\t\n\ttype InitSignInPasswordlessResult {\n\t\trequestId: String!\n\t\texpiresAt: DateTime!\n\t}\n\n\tinput InitSignInPasswordlessOptions {\n\t\tmailVariant: String\n\t\tmailProject: String\n\t}\n\t\n\ttype SignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: SignInPasswordlessError\n\t\tresult: SignInPasswordlessResult\n\t}\n\t\n\tenum PasswordlessValidationType {\n\t\totp\n\t\ttoken\n\t}\n\t\n\ttype SignInPasswordlessError {\n\t\tcode: SignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum SignInPasswordlessErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t\tPERSON_DISABLED\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\t\n\ttype SignInPasswordlessResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\t\n\ttype ActivatePasswordlessOtpResponse {\n\t\tok: Boolean!\n\t\terror: ActivatePasswordlessOtpError\n\t}\n\t\n\ttype ActivatePasswordlessOtpError {\n\t\tcode: ActivatePasswordlessOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ActivatePasswordlessOtpErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t}\n\t\n\ttype ToggleMyPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: ToggleMyPasswordlessError\n\t}\n\t\n\ttype ToggleMyPasswordlessError {\n\t\tcode: ToggleMyPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ToggleMyPasswordlessErrorCode {\n\t\tCANNOT_TOGGLE\n NOT_A_PERSON\n\t}\n\t\n\n\t# === invite ===\n\n\ttype InviteResponse {\n\t\tok: Boolean!\n\t\terrors: [InviteError!]! @deprecated\n\t\terror: InviteError\n\t\tresult: InviteResult\n\t}\n\n\ttype InviteError {\n\t\tcode: InviteErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InviteErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\t\tINVALID_EMAIL_FORMAT\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype InviteResult {\n\t\tperson: Person!\n\t\tisNew: Boolean!\n\t}\n\n\tenum InviteMethod {\n\t\tCREATE_PASSWORD\n\t\tRESET_PASSWORD\n\t}\n\n\tinput InviteOptions {\n\t\tmethod: InviteMethod\n\t\tmailVariant: String\n\t}\n\n\tinput UnmanagedInviteOptions {\n\t\tpassword: String\n\t\tresetTokenHash: String\n\t}\n\n\t# === addProjectMember ===\n\n\ttype AddProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [AddProjectMemberError!]!\n\t\terror: AddProjectMemberError\n\t}\n\n\ttype AddProjectMemberError {\n\t\tcode: AddProjectMemberErrorCode!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tIDENTITY_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === updateProjectMember ===\n\n\ttype UpdateProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [UpdateProjectMemberError!]! @deprecated\n\t\terror: UpdateProjectMemberError\n\t}\n\n\ttype UpdateProjectMemberError {\n\t\tcode: UpdateProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum UpdateProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tNOT_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === removeProjectMember ===\n\n\ttype RemoveProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveProjectMemberError!]!\n\t\terror: RemoveProjectMemberError\n\t}\n\n\ttype RemoveProjectMemberError {\n\t\tcode: RemoveProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveProjectMemberErrorCode {\n\t\tNOT_MEMBER\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === createApiKey ===\n\n\ttype CreateApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [CreateApiKeyError!]! @deprecated\n\t\terror: CreateApiKeyError\n\t\tresult: CreateApiKeyResult\n\t}\n\n\ttype CreateApiKeyError {\n\t\tcode: CreateApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreateApiKeyErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_MEMBERSHIP\n\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype CreateApiKeyResult {\n\t\tapiKey: ApiKeyWithToken!\n\t}\n\n\t# === disableApiKey ===\n\n\ttype DisableApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableApiKeyError!]! @deprecated\n\t\terror: DisableApiKeyError\n\t}\n\n\ttype DisableApiKeyError {\n\t\tcode: DisableApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableApiKeyErrorCode {\n\t\tKEY_NOT_FOUND\n\t}\n\t# === addGlobalIdentityRoles ===\n\n\ttype AddGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: AddGlobalIdentityRolesError\n\t\tresult: AddGlobalIdentityRolesResult\n\t}\n\n\ttype AddGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\ttype AddGlobalIdentityRolesError {\n\t\tcode: AddGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\n\n\t# === removeGlobalIdentityRoles ===\n\n\ttype RemoveGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: RemoveGlobalIdentityRolesError\n\t\tresult: RemoveGlobalIdentityRolesResult\n\t}\n\n\ttype RemoveGlobalIdentityRolesError {\n\t\tcode: RemoveGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype RemoveGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\n\tenum RemoveGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\t# === common ===\n\n\t# === variables ===\n\n\tinput VariableEntryInput {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\ttype VariableEntry {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\t# === membership ===\n\n\tinput MembershipInput {\n\t\trole: String!\n\t\tvariables: [VariableEntryInput!]!\n\t}\n\n\ttype Membership {\n\t\trole: String!\n\t\tvariables: [VariableEntry!]!\n\t}\n\n\ttype MembershipValidationError {\n\t\tcode: MembershipValidationErrorCode!\n\t\trole: String!\n\t\tvariable: String\n\t}\n\n\tenum MembershipValidationErrorCode {\n\t\tROLE_NOT_FOUND\n\t\tVARIABLE_NOT_FOUND\n\t\tVARIABLE_EMPTY\n\t\tVARIABLE_INVALID\n\t}\n\n\t# === person ====\n\n\ttype Person {\n\t\tid: String!\n\t\temail: String\n\t\tname: String\n\t\totpEnabled: Boolean!\n\t\tpasswordlessEnabled: Boolean\n\t\tidentity: Identity!\n\t}\n\n\t# === api key ===\n\n\ttype ApiKey {\n\t\tid: String!\n\t\tidentity: Identity!\n\t}\n\n\ttype ApiKeyWithToken {\n\t\tid: String!\n\t\ttoken: String\n\t\tidentity: Identity!\n\t}\n\n\t# === identity ===\n\n\ttype Identity {\n\t\tid: String!\n\t\tdescription: String\n\t\tperson: Person\n\t\tapiKey: ApiKey\n\t\tprojects: [IdentityProjectRelation!]!\n\t\tpermissions: IdentityGlobalPermissions\n\t\troles: [String!]\n\t}\n\n\ttype IdentityGlobalPermissions {\n\t\tcanCreateProject: Boolean!\n\t\tcanDeployEntrypoint: Boolean!\n\t}\n\n\ttype IdentityProjectRelation {\n\t\tproject: Project!\n\t\tmemberships: [Membership!]!\n\t}\n\n\t# === project ===\n\n\ttype Project {\n\t\tid: String!\n\t\tname: String!\n\t\tslug: String!\n\t\tconfig: Json!\n\t\troles: [RoleDefinition!]!\n\t\tmembers(\n\t\t\tinput: ProjectMembersInput,\n\t\t\tmemberType: MemberType @deprecated(reason: \"Use args\")\n\t\t): [ProjectIdentityRelation!]!\n\t}\n\n\tinput ProjectMembersInput {\n\t\tlimit: Int\n\t\toffset: Int\n\t\tfilter: ProjectMembersFilter\n\t}\n\n\tinput ProjectMembersFilter {\n\t\tmemberType: MemberType\n\t\temail: [String!]\n\t\tidentityId: [String!]\n\t\tpersonId: [String!]\n\t}\n\n\tenum MemberType {\n\t\tAPI_KEY\n\t\tPERSON\n\t}\n\n\ttype ProjectIdentityRelation {\n\t\tidentity: Identity!\n\t\tmemberships: [Membership!]!\n\t}\n\n\ttype RoleDefinition {\n\t\tname: String!\n\t\tvariables: [RoleVariableDefinition!]!\n\t}\n\n\tinterface RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\ttype RoleEntityVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tentityName: String!\n\t}\n\n\ttype RolePredefinedVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tvalue: String!\n\t}\n\n\ttype RoleConditionVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\t# ==== 2fa ====\n\n\ttype PrepareOtpResponse {\n\t\tok: Boolean!\n\t\tresult: PrepareOtpResult\n\t}\n\n\ttype PrepareOtpResult {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\ttype ConfirmOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [ConfirmOtpError!]! @deprecated\n\t\terror: ConfirmOtpError\n\t}\n\n\ttype ConfirmOtpError {\n\t\tcode: ConfirmOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ConfirmOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t\tNOT_PREPARED\n\t}\n\n\ttype DisableOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableOtpError!]! @deprecated\n\t\terror: DisableOtpError\n\t}\n\n\ttype DisableOtpError {\n\t\tcode: DisableOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableOtpErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t}\n\n\ttype DisablePersonResponse {\n\t\tok: Boolean!\n\t\terror: DisablePersonError\n\t}\n\n\ttype DisablePersonError {\n\t\tcode: DisablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisablePersonErrorCode {\n\t\tPERSON_ALREADY_DISABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === mails ===\n\t\n\ttype MailTemplateData {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean!\n\t\treplyTo: String\n\t}\n\t\n\tinput MailTemplate {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\t\"Custom mail variant identifier, e.g. a locale.\"\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean\n\t\treplyTo: String\n\t}\n\n\tenum MailType {\n\t\tEXISTING_USER_INVITED\n\t\tNEW_USER_INVITED\n\t\tRESET_PASSWORD_REQUEST\n\t\tPASSWORDLESS_SIGN_IN\n\t}\n\n\tinput MailTemplateIdentifier {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t}\n\n\ttype AddMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [AddMailTemplateError!]! @deprecated\n\t\terror: AddMailTemplateError\n\t}\n\n\ttype AddMailTemplateError {\n\t\tcode: AddMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddMailTemplateErrorCode {\n\t\tMISSING_VARIABLE\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_REPLY_EMAIL_FORMAT\n\t}\n\n\ttype RemoveMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveMailTemplateError!]!\n\t\terror: RemoveMailTemplateError\n\t}\n\n\ttype RemoveMailTemplateError {\n\t\tcode: RemoveMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveMailTemplateErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tTEMPLATE_NOT_FOUND\n\t}\n\n\t# === password reset ===\n\n\ttype CheckResetPasswordTokenResult {\n\t\tcode: CheckResetPasswordTokenCode!\n\t}\n\n\tenum CheckResetPasswordTokenCode {\n\t\tREQUEST_NOT_FOUND\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype CreatePasswordResetRequestResponse {\n\t\tok: Boolean!\n\t\terrors: [CreatePasswordResetRequestError!]! @deprecated\n\t\terror: CreatePasswordResetRequestError\n\t}\n\n\ttype CreatePasswordResetRequestError {\n\t\tcode: CreatePasswordResetRequestErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreatePasswordResetRequestErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\ttype ResetPasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ResetPasswordError!]! @deprecated\n\t\terror: ResetPasswordError\n\t}\n\ttype ResetPasswordError {\n\t\tcode: ResetPasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ResetPasswordErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\n\t\tPASSWORD_TOO_WEAK\n\t}\n\n\tinput CreateResetPasswordRequestOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\t# === project ===\n\n\tinput ProjectSecret {\n\t\tkey: String!\n\t\tvalue: String!\n\t}\n\n\tinput CreateProjectOptions {\n\t\tdeployTokenHash: String\n\t\tnoDeployToken: Boolean\n\t}\n\n\ttype CreateProjectResponse {\n\t\tok: Boolean!\n\t\terror: CreateProjectResponseError\n\t\tresult: CreateProjectResult\n\t}\n\n\ttype CreateProjectResponseError {\n\t\tcode: CreateProjectResponseErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype CreateProjectResult {\n\t\tdeployerApiKey: ApiKeyWithToken\n\t}\n\n\tenum CreateProjectResponseErrorCode {\n\t\tALREADY_EXISTS\n\t\tINIT_ERROR\n\t}\n\n\ttype SetProjectSecretResponse {\n\t\tok: Boolean!\n\t\terror: SetProjectSecretError\n\t}\n\n\ttype SetProjectSecretError {\n\t\tcode: SetProjectSecretErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum SetProjectSecretErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateProjectResponse {\n\t\tok: Boolean!\n\t\terror: UpdateProjectError\n\t}\n\n\ttype UpdateProjectError {\n\t\tcode: UpdateProjectErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateProjectErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n`\n\nexport default schema\n"],"names":["gql"],"mappings":";;AAGA,MAAM,SAAuBA,WAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;;"}

package/dist/production/src/schema/tenant.graphql.js CHANGED Viewed

@@ -389,6 +389,7 @@ const schema = gql`
 	type SignInIDPResult implements CommonSignInResult {
 		token: String!
 		person: Person!
+		idpResponse: Json
 	}
 	type AddIDPResponse {