@contember/engine-tenant-api 2.0.0-alpha.9 → 2.0.0-beta.1

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -1,5 +1,5 @@
 import { Client, Issuer } from 'openid-client'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
 import { catchTypesafe } from './helpers'
 import { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'
@@ -16,15 +16,20 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await initOIDCAuth(client, {
-			claims: configuration.claims,
+			scope: configuration.scope ?? configuration.claims,
 			...initData,
 		})
 	}
 
-	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
-		return await handleOIDCResponse(client, responseData)
+		return await handleOIDCResponse(
+			client,
+			responseData,
+			configuration.fetchUserInfo,
+			configuration.returnOIDCResult,
+		)
 	}
 
 
@@ -40,6 +45,7 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 				client_id: configuration.clientId,
 				client_secret: configuration.clientSecret,
 				response_types: [configuration.responseType || 'code'],
+				id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',
 			},
 			undefined,
 			{

package/src/model/service/idp/providers/OIDCTypes.ts

@@ -8,8 +8,12 @@ export interface OIDCSessionData {
 
 export const OIDCConfigurationOptions = Typesafe.partial({
 	responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
-	claims: Typesafe.string,
+	claims: Typesafe.string, // deprecated, use scope instead
+	scope: Typesafe.string,
 	additionalAuthorizedParties: Typesafe.array(Typesafe.string),
+	idTokenSignedResponseAlg: Typesafe.string,
+	fetchUserInfo: Typesafe.boolean,
+	returnOIDCResult: Typesafe.boolean,
 })
 export const BaseOIDCConfiguration = Typesafe.intersection(
 	Typesafe.object({

package/src/model/type/PersonToken.ts

@@ -0,0 +1,21 @@
+export namespace PersonToken {
+	export type Type = 'password_reset' | 'passwordless'
+	export type ValidationType = 'token' | 'otp'
+
+	export interface Row {
+		id: string
+		created_at: Date
+		token_hash: string
+		used_at: null | Date
+		expires_at: Date
+		person_id: string
+		otp_hash: string | null
+		otp_attempts: number
+	}
+
+	export type TokenValidationError =
+		| 'TOKEN_NOT_FOUND'
+		| 'TOKEN_INVALID'
+		| 'TOKEN_USED'
+		| 'TOKEN_EXPIRED'
+}

package/src/model/type/index.ts

@@ -2,3 +2,4 @@ export * from './ApiKey'
 export * from './IdentityProvider'
 export * from './Project'
 export * from './Variables'
+export * from './PersonToken'

package/src/model/utils/tokenUtils.ts

@@ -1,5 +1,8 @@
 import crypto from 'node:crypto'
 import { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'
+import { PersonToken } from '../type'
+import { ImplementationException } from '../../exceptions'
+import { Response, ResponseError, ResponseOk } from './Response'
 
 export const generateToken = async (generator: {
 	randomBytes: (bytes: number) => Promise<Buffer>
@@ -17,3 +20,47 @@ export const computeTokenHash = (token: string): TokenHash => {
 }
 
 export const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)
+
+
+const MAX_OTP_ATTEMPTS = 3
+
+export const validateToken = ({ entry, validationType, token, now }: {
+	entry: PersonToken.Row | null
+	validationType: PersonToken.ValidationType
+	token: string
+	now: Date
+}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {
+	if (!entry) {
+		return new ResponseError('TOKEN_NOT_FOUND', 'Token not found')
+	}
+	if (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {
+		return new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')
+	}
+	switch (validationType) {
+		case 'token':
+			if (entry.otp_hash !== null) {
+				return new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')
+			}
+			if (entry.token_hash !== computeTokenHash(token)) {
+				return new ResponseError('TOKEN_INVALID', 'Token invalid')
+			}
+			break
+		case 'otp':
+			if (entry.otp_hash === null) {
+				return new ResponseError('TOKEN_INVALID', 'OTP not set')
+			}
+			if (entry.otp_hash !== computeTokenHash(token)) {
+				return new ResponseError('TOKEN_INVALID', 'OTP invalid')
+			}
+			break
+		default:
+			throw new ImplementationException()
+	}
+	if (entry.used_at) {
+		return new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())
+	}
+	if (entry.expires_at < now) {
+		return new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())
+	}
+	return new ResponseOk(entry)
+}

package/src/resolvers/ResolverFactory.ts

@@ -31,6 +31,10 @@ import { IDPQueryResolver } from './query/IDPQueryResolver'
 import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver'
 import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver'
 import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver'
+import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver'
+import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver'
+import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver'
+import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver'
 
 class ResolverFactory {
 	public constructor(
@@ -53,6 +57,7 @@ class ResolverFactory {
 			disableIdpMutationResolver: DisableIDPMutationResolver
 			enableIdpMutationResolver: EnableIDPMutationResolver
 			updateIdpMutationResolver: UpdateIDPMutationResolver
+			passwordlessMutationResolver: PasswordlessMutationResolver
 
 			disablePersonMutationResolver: DisablePersonMutationResolver
 
@@ -77,6 +82,11 @@ class ResolverFactory {
 
 			identityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver
 
+			configurationMutationResolver: ConfigurationMutationResolver
+			configurationQueryResolver: ConfigurationQueryResolver
+
+			togglePasswordlessMutationResolver: TogglePasswordlessMutationResolver
+
 		},
 	) { }
 
@@ -102,6 +112,7 @@ class ResolverFactory {
 				projectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),
 				identityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),
 				mailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),
+				configuration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),
 				checkResetPasswordToken: () => {
 					throw new Error('not implemented')
 				},
@@ -127,6 +138,12 @@ class ResolverFactory {
 				updateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),
 				disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
 
+				signInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),
+				initSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),
+				activatePasswordlessOtp: this.resolvers.passwordlessMutationResolver.activatePasswordlessOtp.bind(this.resolvers.passwordlessMutationResolver),
+				disableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.disableMyPasswordless.bind(this.resolvers.togglePasswordlessMutationResolver),
+				enableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.enableMyPasswordless.bind(this.resolvers.togglePasswordlessMutationResolver),
+
 				invite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),
 				unmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),
 
@@ -154,6 +171,8 @@ class ResolverFactory {
 
 				addGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(this.resolvers.identityGlobalRolesMutationResolver),
 				removeGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(this.resolvers.identityGlobalRolesMutationResolver),
+
+				configure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),
 			},
 		}
 	}

package/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts

@@ -0,0 +1,29 @@
+import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
+import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions } from '../../../model'
+import { createErrorResponse } from '../../errorUtils'
+
+export class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {
+	constructor(
+		private readonly configurationManager: ConfigurationManager,
+	) {
+	}
+
+	async configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to configure',
+		})
+
+		const result = await this.configurationManager.updateConfiguration(context.db, config)
+
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return {
+			ok: true,
+		}
+	}
+}

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -55,7 +55,10 @@ export class IDPMutationResolver implements MutationResolvers {
 		return {
 			ok: true,
 			errors: [],
-			result: await this.signInResponseFactory.createResponse(signIn.result, context),
+			result: {
+				...await this.signInResponseFactory.createResponse(signIn.result, context),
+				idpResponse: signIn.result.idpResponse,
+			},
 		}
 	}
 }

package/src/resolvers/mutation/person/PasswordlessMutationResolver.ts

@@ -0,0 +1,81 @@
+import {
+	ActivatePasswordlessOtpResponse,
+	InitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,
+	MutationInitSignInPasswordlessArgs,
+	MutationResolvers,
+	MutationSignInPasswordlessArgs,
+	SignInPasswordlessResponse,
+} from '../../../schema'
+import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions } from '../../../model'
+import { createErrorResponse } from '../../errorUtils'
+import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
+import { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'
+
+export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {
+	constructor(
+		private readonly passwordlessSignInManager: PasswordlessSignInManager,
+		private readonly signInResponseFactory: SignInResponseFactory,
+	) {}
+
+	async initSignInPasswordless(
+		parent: any,
+		args: MutationInitSignInPasswordlessArgs,
+		context: TenantResolverContext,
+	): Promise<InitSignInPasswordlessResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,
+			message: 'You are not allowed to request passwordless sign in',
+		})
+		const result = await this.passwordlessSignInManager.initSignInPasswordless({
+			db: context.db,
+			permissionContext: context.permissionContext,
+			email: args.email,
+			mailVariant: args.options?.mailVariant ?? undefined,
+			mailProject: args.options?.mailProject ?? undefined,
+		})
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+		return { ok: true, result: result.result }
+	}
+
+	async signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+			message: 'You are not allowed to sign in using passwordless',
+		})
+		const signIn = await this.passwordlessSignInManager.signInPasswordless({
+			db: context.db,
+			requestId: args.requestId,
+			token: args.token,
+			mfaOtp: args.mfaOtp ?? undefined,
+			validationType: args.validationType,
+			expiration: args.expiration ?? undefined,
+		})
+		if (!signIn.ok) {
+			return createErrorResponse(signIn.error, signIn.errorMessage)
+		}
+		return {
+			ok: true,
+			result: await this.signInResponseFactory.createResponse(signIn.result, context),
+		}
+	}
+
+	async activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+			message: 'You are not allowed to activate passwordless OTP',
+		})
+		const result = await this.passwordlessSignInManager.activatePasswordlessOtp({
+			db: context.db,
+			requestId: args.requestId,
+			token: args.token,
+			otpHash: args.otpHash,
+		})
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+		return { ok: true }
+	}
+}

package/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts

@@ -1,22 +1,13 @@
 import {
-	CreatePasswordResetRequestErrorCode,
 	CreatePasswordResetRequestResponse,
 	MutationCreateResetPasswordRequestArgs,
 	MutationResetPasswordArgs,
 	MutationResolvers,
-	ResetPasswordErrorCode as SchemaResetPasswordErrorCode,
 	ResetPasswordResponse,
 } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import {
-	PasswordResetManager,
-	PermissionActions,
-	PermissionContextFactory,
-	PersonQuery,
-	ResetPasswordCommandErrorCode,
-	ResetPasswordErrorCode,
-} from '../../../model'
+import { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 
 export class ResetPasswordMutationResolver implements MutationResolvers {

package/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts

@@ -0,0 +1,44 @@
+import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
+import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions, PersonManager, PersonQuery } from '../../../model'
+import { createErrorResponse } from '../../errorUtils'
+
+export class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {
+	constructor(
+		private readonly configurationManager: ConfigurationManager,
+		private readonly personManager: PersonManager,
+	) {
+	}
+
+	async enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {
+		return this.doTogglePasswordless(context, true)
+	}
+
+	async disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {
+		return this.doTogglePasswordless(context, false)
+	}
+
+	private async doTogglePasswordless(
+		context: TenantResolverContext,
+		value: boolean,
+	): Promise<ToggleMyPasswordlessResponse> {
+		const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))
+		if (!person) {
+			return createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')
+		}
+		await context.requireAccess({
+			action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
+			message: 'You are not allowed to enable passwordless',
+		})
+		const config = await this.configurationManager.fetchConfiguration(context.db)
+		if (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {
+			return createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')
+		}
+
+		await this.personManager.togglePasswordless(context.db, person, value)
+
+		return { ok: true }
+	}
+
+}

package/src/resolvers/query/ConfigurationQueryResolver.ts

@@ -0,0 +1,21 @@
+import { Config, QueryResolvers } from '../../schema'
+import { PermissionActions } from '../../model'
+import { TenantResolverContext } from '../TenantResolverContext'
+import { ConfigurationManager } from '../../model/service/ConfigurationManager'
+
+export class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {
+
+	constructor(
+		private readonly configurationManager: ConfigurationManager,
+	) {
+	}
+
+	async configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIG_VIEW,
+			message: 'You are not allowed to view configuration',
+		})
+
+		return await this.configurationManager.fetchConfiguration(context.db)
+	}
+}

package/src/resolvers/responseHelpers/PersonResponseFactory.ts

@@ -8,6 +8,7 @@ export class PersonResponseFactory {
 			otpEnabled: !!personRow.otp_activated_at,
 			email: personRow.email,
 			name: personRow.name,
+			passwordlessEnabled: personRow.passwordless_enabled,
 			identity: {
 				id: personRow.identity_id,
 				projects,

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -48,11 +48,11 @@ export class ProjectTypeResolver implements ProjectResolvers {
 			variables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {
 				switch (variableDef.type) {
 					case Acl.VariableType.entity:
-						return { __typename: 'RoleEntityVariableDefinition', name, entityName: variableDef.entityName }
+						return { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }
 					case Acl.VariableType.predefined:
-						return { __typename: 'RolePredefinedVariableDefinition', name, value: variableDef.value }
+						return { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }
 					case Acl.VariableType.condition:
-						return { __typename: 'RoleConditionVariableDefinition', name }
+						return { __typename: 'RoleConditionVariableDefinition' as const, name }
 				}
 			}),
 		}))