@contember/engine-tenant-api 2.0.0-alpha.18 → 2.0.0-alpha.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.0.0-alpha.18",
+  "version": "2.0.0-alpha.20",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,30 +26,30 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.0.0-alpha.18",
-    "@contember/config-loader": "2.0.0-alpha.18",
-    "@contember/database": "2.0.0-alpha.18",
-    "@contember/database-migrations": "2.0.0-alpha.18",
-    "@contember/dic": "2.0.0-alpha.18",
-    "@contember/graphql-utils": "2.0.0-alpha.18",
-    "@contember/logger": "2.0.0-alpha.18",
-    "@contember/schema": "2.0.0-alpha.18",
-    "@contember/schema-utils": "2.0.0-alpha.18",
-    "@contember/typesafe": "2.0.0-alpha.18",
-    "@graphql-tools/utils": "^10.5.4",
+    "@contember/authorization": "2.0.0-alpha.20",
+    "@contember/config-loader": "2.0.0-alpha.20",
+    "@contember/database": "2.0.0-alpha.20",
+    "@contember/database-migrations": "2.0.0-alpha.20",
+    "@contember/dic": "2.0.0-alpha.20",
+    "@contember/graphql-utils": "2.0.0-alpha.20",
+    "@contember/logger": "2.0.0-alpha.20",
+    "@contember/schema": "2.0.0-alpha.20",
+    "@contember/schema-utils": "2.0.0-alpha.20",
+    "@contember/typesafe": "2.0.0-alpha.20",
+    "@graphql-tools/utils": "^10.5.5",
     "graphql-tag": "^2.12.6",
     "jose": "^5.8.0",
     "mustache": "^4.2.0",
     "nodemailer": "^6.9.15",
     "openid-client": "^5.7.0",
-    "otpauth": "^9.3.2"
+    "otpauth": "^9.3.4"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.0.0-alpha.18",
-    "@graphql-tools/schema": "^10.0.6",
+    "@contember/database-tester": "2.0.0-alpha.20",
+    "@graphql-tools/schema": "^10.0.7",
     "@types/mustache": "^4.2.5",
-    "@types/node": "^20.16.5",
-    "@types/nodemailer": "^6.4.15",
+    "@types/node": "^20.16.11",
+    "@types/nodemailer": "^6.4.16",
     "graphql": "^16.9.0"
   },
   "peerDependencies": {

package/src/model/service/IDPSignInManager.ts

@@ -1,6 +1,6 @@
 import { ApiKeyManager } from './apiKey'
 import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'
-import { IDPClaim, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
+import { IDPResponse, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'
 import { DatabaseContext } from '../utils'
@@ -28,7 +28,7 @@ class IDPSignInManager {
 			}
 			const providerService = this.idpRegistry.getHandler(provider.type)
 			const validatedConfig = providerService.validateConfiguration(provider.configuration)
-			let claim: IDPClaim
+			let claim: IDPResponse
 			try {
 				claim = await providerService.processResponse(
 					validatedConfig,
@@ -54,7 +54,7 @@ class IDPSignInManager {
 			}
 
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
-			return new ResponseOk({ person: personRow, token: sessionToken })
+			return new ResponseOk({ person: personRow, token: sessionToken, idpResponse: claim })
 		})
 	}
 
@@ -84,7 +84,7 @@ class IDPSignInManager {
 		}
 	}
 
-	private async resolvePerson(db: DatabaseContext, claim: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow | null> {
+	private async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow | null> {
 		const personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)
 		const personByIdp = await db.queryHandler.fetch(personByIdPQuery)
 		if (personByIdp) {
@@ -108,7 +108,7 @@ class IDPSignInManager {
 		return null
 	}
 
-	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow> {
+	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {
 		const roles = [TenantRole.PERSON]
 		const identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))
 		const newPerson = await db.commandBus.execute(new CreatePersonCommand({
@@ -125,7 +125,7 @@ class IDPSignInManager {
 		}
 	}
 
-	private async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPClaim, person: PersonRow) {
+	private async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {
 		await db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))
 	}
 }
@@ -136,6 +136,7 @@ namespace IDPSignInManager {
 	interface SignInIDPResult {
 		readonly person: PersonRow
 		readonly token: string
+		readonly idpResponse?: Record<string, unknown>
 	}
 
 	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>

package/src/model/service/idp/IdentityProviderHandler.ts

@@ -3,17 +3,17 @@ export interface InitIDPAuthResult {
 	sessionData: unknown
 }
 
-export interface IDPClaim {
+export type IDPResponse = {
 	externalIdentifier: string
 	email?: string
 	name?: string
-}
+} & Record<string, unknown>
 
 export interface IdentityProviderHandler<Configuration extends {}> {
 
 	initAuth: (configuration: Configuration, data: unknown) => Promise<InitIDPAuthResult>
 
-	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPClaim>
+	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPResponse>
 
 	validateConfiguration: (config: unknown) => Configuration
 

package/src/model/service/idp/providers/AppleProvider.ts

@@ -1,5 +1,5 @@
 import * as Typesafe from '@contember/typesafe'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'
 import { catchTypesafe } from './helpers'
 import { IDPValidationError } from '../IDPValidationError'
@@ -31,12 +31,12 @@ export class AppleProvider implements IdentityProviderHandler<AppleConfiguration
 		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await initOIDCAuth(client, {
-			claims: configuration.claims,
+			scope: configuration.scope ?? configuration.claims,
 			...initData,
 		})
 	}
 
-	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await handleOIDCResponse(client, responseData)

package/src/model/service/idp/providers/FacebookProvider.ts

@@ -1,6 +1,6 @@
 import * as Typesafe from '@contember/typesafe'
 import { Client, Issuer } from 'openid-client'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { IDPValidationError } from '../IDPValidationError'
 import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
 import { catchTypesafe } from './helpers'
@@ -80,12 +80,12 @@ export class FacebookProvider implements IdentityProviderHandler<FacebookConfigu
 		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await initOIDCAuth(client, {
-			claims: configuration.claims,
+			scope: configuration.scope ?? configuration.claims,
 			...initData,
 		})
 	}
 
-	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)
 
 		if (!('authResponse' in responseData)) {

package/src/model/service/idp/providers/OIDCHelpers.ts

@@ -2,19 +2,19 @@ import { Client, custom, errors, generators } from 'openid-client'
 import { OIDCResponseData } from './OIDCTypes'
 import { IDPValidationError } from '../IDPValidationError'
 import { IDPResponseError } from '../IDPResponseError'
-import { IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 
 custom.setHttpOptionsDefaults({
 	timeout: 5000,
 })
 
-export const initOIDCAuth = async (client: Client, { redirectUrl, claims, responseMode }: { redirectUrl: string; claims?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {
+export const initOIDCAuth = async (client: Client, { redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {
 	const nonce = generators.nonce()
 	const state = generators.state()
 	const url = client.authorizationUrl({
 		redirect_uri: redirectUrl,
 		response_mode: responseMode,
-		scope: claims ?? 'openid email',
+		scope: scope ?? 'openid email',
 		nonce,
 		state,
 	})
@@ -25,7 +25,7 @@ export const initOIDCAuth = async (client: Client, { redirectUrl, claims, respon
 	}
 }
 
-export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPClaim> => {
+export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData, fetchUserInfo?: boolean): Promise<IDPResponse> => {
 	const params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)
 	if (params.state && !sessionData?.state) {
 		throw new IDPValidationError(`state is present in parameters, but missing in session data`)
@@ -33,10 +33,13 @@ export const handleOIDCResponse = async (client: Client, { sessionData, redirect
 	try {
 		const result = await client.callback(redirectUrl, params, sessionData)
 		const claims = result.claims()
+		const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims
+		const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}
+
 		return {
 			externalIdentifier: claims.sub,
-			email: claims.email,
-			name: claims.name,
+			...claimsWithoutHashes,
+			...userInfo,
 		}
 	} catch (e: any) {
 		if (e instanceof errors.RPError) {

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -1,5 +1,5 @@
 import { Client, Issuer } from 'openid-client'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
 import { catchTypesafe } from './helpers'
 import { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'
@@ -16,15 +16,15 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await initOIDCAuth(client, {
-			claims: configuration.claims,
+			scope: configuration.scope ?? configuration.claims,
 			...initData,
 		})
 	}
 
-	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
-		return await handleOIDCResponse(client, responseData)
+		return await handleOIDCResponse(client, responseData, configuration.fetchUserInfo)
 	}
 
 

package/src/model/service/idp/providers/OIDCTypes.ts

@@ -8,9 +8,11 @@ export interface OIDCSessionData {
 
 export const OIDCConfigurationOptions = Typesafe.partial({
 	responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
-	claims: Typesafe.string,
+	claims: Typesafe.string, // deprecated, use scope instead
+	scope: Typesafe.string,
 	additionalAuthorizedParties: Typesafe.array(Typesafe.string),
 	idTokenSignedResponseAlg: Typesafe.string,
+	fetchUserInfo: Typesafe.boolean,
 })
 export const BaseOIDCConfiguration = Typesafe.intersection(
 	Typesafe.object({

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -55,7 +55,10 @@ export class IDPMutationResolver implements MutationResolvers {
 		return {
 			ok: true,
 			errors: [],
-			result: await this.signInResponseFactory.createResponse(signIn.result, context),
+			result: {
+				...await this.signInResponseFactory.createResponse(signIn.result, context),
+				idpResponse: signIn.result.idpResponse,
+			},
 		}
 	}
 }

package/src/schema/index.ts

@@ -1270,6 +1270,7 @@ export type SignInIdpResponse = {
 
 export type SignInIdpResult = CommonSignInResult & {
 	readonly __typename?: 'SignInIDPResult'
+	readonly idpResponse?: Maybe<Scalars['Json']['output']>
 	readonly person: Person
 	readonly token: Scalars['String']['output']
 }
@@ -2518,6 +2519,7 @@ export type SignInIdpResponseResolvers<ContextType = any, ParentType extends Res
 }
 
 export type SignInIdpResultResolvers<ContextType = any, ParentType extends ResolversParentTypes['SignInIDPResult'] = ResolversParentTypes['SignInIDPResult']> = {
+	idpResponse?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
 	person?: Resolver<ResolversTypes['Person'], ParentType, ContextType>
 	token?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>

package/src/schema/tenant.graphql.ts

@@ -391,6 +391,7 @@ const schema: DocumentNode = gql`
 	type SignInIDPResult implements CommonSignInResult {
 		token: String!
 		person: Person!
+		idpResponse: Json
 	}
 
 	type AddIDPResponse {

package/tests/src/IdPMock.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../../src'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../../src'
 
 export class IdPMock implements IdentityProviderHandler<any> {
 	initAuth(configuration: any, data: unknown): Promise<InitIDPAuthResult> {
@@ -8,7 +8,7 @@ export class IdPMock implements IdentityProviderHandler<any> {
 		})
 	}
 
-	processResponse(configuration: any, responseData: any): Promise<IDPClaim> {
+	processResponse(configuration: any, responseData: any): Promise<IDPResponse> {
 		return Promise.resolve({
 			externalIdentifier: configuration.externalIdentifier,
 			email: configuration.email,