@contember/engine-tenant-api 2.0.0-alpha.9 → 2.0.0-beta.2

package/src/model/mailing/templates/PasswordlessSignIn.mustache.ts

@@ -0,0 +1,15 @@
+import Layout from './Layout.mustache'
+// language=Mustache
+export default Layout(`
+	<p>Hello,</p>
+	<p>
+		sign in was requested for your account ({{email}}):<br>
+		{{#url}}
+			<p>Click the following link to sign in:</p>
+			<a href="{{url}}">{{url}}</a>
+		{{/url}}
+		{{^url}}
+			<p>Passwordless sign-in is misconfigured. Please contact your administrator.</p>
+		{{/url}}
+	</p>
+`)

package/src/model/mailing/type.ts

@@ -4,6 +4,7 @@ export enum MailType {
 	existingUserInvited = 'existingUserInvited',
 	newUserInvited = 'newUserInvited',
 	passwordReset = 'passwordReset',
+	passwordlessSignIn = 'passwordlessSignIn',
 }
 
 export const mailTypeFromSchemaToDb = (type: SchemaMailType): MailType => {
@@ -11,6 +12,7 @@ export const mailTypeFromSchemaToDb = (type: SchemaMailType): MailType => {
 		EXISTING_USER_INVITED: MailType.existingUserInvited,
 		NEW_USER_INVITED: MailType.newUserInvited,
 		RESET_PASSWORD_REQUEST: MailType.passwordReset,
+		PASSWORDLESS_SIGN_IN: MailType.passwordlessSignIn,
 	}[type]
 }
 
@@ -19,6 +21,7 @@ export const mailTypeFromDbToSchema = (type: MailType): SchemaMailType => {
 		[MailType.existingUserInvited]: 'EXISTING_USER_INVITED' as const,
 		[MailType.newUserInvited]: 'NEW_USER_INVITED' as const,
 		[MailType.passwordReset]: 'RESET_PASSWORD_REQUEST' as const,
+		[MailType.passwordlessSignIn]: 'PASSWORDLESS_SIGN_IN' as const,
 	}[type]
 }
 

package/src/model/queries/configuration/ConfigurationQuery.ts

@@ -0,0 +1,30 @@
+import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'
+import { Config, ConfigPolicy } from '../../../schema'
+
+export class ConfigurationQuery extends DatabaseQuery<Config> {
+
+	async fetch({ db }: DatabaseQueryable): Promise<Config> {
+		const rows = await SelectBuilder.create<ConfigurationRow>()
+			.from('config')
+			.select(new Literal('*'))
+			.getResult(db)
+		const result = this.fetchOneOrNull(rows)
+		if (!result) {
+			throw new Error('Configuration not found')
+		}
+
+		return {
+			passwordless: {
+				enabled: result.passwordless_enabled,
+				url: result.passwordless_url,
+				expirationMinutes: result.passwordless_expiration_minutes,
+			},
+		}
+	}
+}
+
+interface ConfigurationRow {
+	passwordless_enabled: ConfigPolicy
+	passwordless_url: string | null
+	passwordless_expiration_minutes: number
+}

package/src/model/queries/configuration/index.ts

@@ -0,0 +1 @@
+export * from './ConfigurationQuery'

package/src/model/queries/index.ts

@@ -1,4 +1,5 @@
 export * from './apiKey'
+export * from './configuration'
 export * from './mailTemplate'
 export * from './membership'
 export * from './person'

package/src/model/queries/person/PersonQueryBuilderFactory.ts

@@ -12,6 +12,7 @@ export class PersonQueryBuilderFactory {
 			.select(['person', 'email'])
 			.select(['person', 'name'])
 			.select(['person', 'disabled_at'])
+			.select(['person', 'passwordless_enabled'])
 			.select(['identity', 'roles'])
 			.from('person')
 			.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))

package/src/model/queries/person/types.ts

@@ -8,6 +8,7 @@ export interface PersonRow {
 	readonly name: string | null
 	readonly roles: string[]
 	readonly disabled_at: Date | null
+	readonly passwordless_enabled: boolean | null
 }
 
 export type MaybePersonRow = PersonRow | null

package/src/model/queries/personToken/PersonTokenQuery.ts

@@ -0,0 +1,35 @@
+import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'
+import { PersonToken } from '../../type'
+import { computeTokenHash } from '../../utils'
+
+export class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {
+
+	private constructor(
+		private readonly identifierType: 'id' | 'token_hash',
+		private readonly identifier: string,
+		private readonly type: PersonToken.Type,
+	) {
+		super()
+	}
+
+	public static byId(id: string, type: PersonToken.Type): PersonTokenQuery {
+		return new PersonTokenQuery('id', id, type)
+	}
+
+	public static byToken(token: string, type: PersonToken.Type): PersonTokenQuery {
+		const tokenHash = computeTokenHash(token)
+		return new PersonTokenQuery('token_hash', tokenHash, type)
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null> {
+		const result = await SelectBuilder.create<PersonToken.Row>()
+			.from('person_token')
+			.select(new Literal('*'))
+			.where({
+				[this.identifierType]: this.identifier,
+				type: this.type,
+			})
+			.getResult(db)
+		return this.fetchOneOrNull(result)
+	}
+}

package/src/model/service/ConfigurationManager.ts

@@ -0,0 +1,22 @@
+import { Config, ConfigInput, ConfigureErrorCode } from '../../schema'
+import { Response, ResponseOk } from '../utils/Response'
+import { DatabaseContext } from '../utils'
+import { UpdateConfigurationCommand } from '../commands'
+import { ConfigurationQuery } from '../queries'
+
+export class ConfigurationManager {
+	constructor() {
+	}
+
+	public async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {
+		// todo: validate configuration
+
+		await db.commandBus.execute(new UpdateConfigurationCommand(configuration))
+
+		return new ResponseOk(null)
+	}
+
+	public async fetchConfiguration(db: DatabaseContext): Promise<Config> {
+		return await db.queryHandler.fetch(new ConfigurationQuery())
+	}
+}

package/src/model/service/IDPSignInManager.ts

@@ -1,6 +1,6 @@
 import { ApiKeyManager } from './apiKey'
 import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'
-import { IDPClaim, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
+import { IDPResponse, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'
 import { DatabaseContext } from '../utils'
@@ -28,7 +28,7 @@ class IDPSignInManager {
 			}
 			const providerService = this.idpRegistry.getHandler(provider.type)
 			const validatedConfig = providerService.validateConfiguration(provider.configuration)
-			let claim: IDPClaim
+			let claim: IDPResponse
 			try {
 				claim = await providerService.processResponse(
 					validatedConfig,
@@ -54,7 +54,7 @@ class IDPSignInManager {
 			}
 
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
-			return new ResponseOk({ person: personRow, token: sessionToken })
+			return new ResponseOk({ person: personRow, token: sessionToken, idpResponse: claim })
 		})
 	}
 
@@ -84,7 +84,7 @@ class IDPSignInManager {
 		}
 	}
 
-	private async resolvePerson(db: DatabaseContext, claim: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow | null> {
+	private async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow | null> {
 		const personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)
 		const personByIdp = await db.queryHandler.fetch(personByIdPQuery)
 		if (personByIdp) {
@@ -108,7 +108,7 @@ class IDPSignInManager {
 		return null
 	}
 
-	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow> {
+	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {
 		const roles = [TenantRole.PERSON]
 		const identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))
 		const newPerson = await db.commandBus.execute(new CreatePersonCommand({
@@ -125,7 +125,7 @@ class IDPSignInManager {
 		}
 	}
 
-	private async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPClaim, person: PersonRow) {
+	private async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {
 		await db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))
 	}
 }
@@ -136,6 +136,7 @@ namespace IDPSignInManager {
 	interface SignInIDPResult {
 		readonly person: PersonRow
 		readonly token: string
+		readonly idpResponse?: Record<string, unknown>
 	}
 
 	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>

package/src/model/service/InviteManager.ts

@@ -1,9 +1,9 @@
 import {
 	CreateIdentityCommand,
 	CreateOrUpdateProjectMembershipCommand,
-	CreatePasswordResetRequestCommand,
 	CreatePersonCommand,
-	SavePasswordResetRequestCommand,
+	CreatePersonTokenCommand,
+	SavePersonTokenCommand,
 } from '../commands'
 import { Providers } from '../providers'
 import { PersonQuery, PersonRow } from '../queries'
@@ -17,6 +17,7 @@ import { DatabaseContext, TokenHash } from '../utils'
 import { NoPassword, PasswordPlain } from '../dtos'
 import { Acl } from '@contember/schema'
 import { validateEmail } from '../utils/email'
+import { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'
 
 export interface InviteData {
 	email: string
@@ -30,8 +31,6 @@ export interface InviteData {
 	passwordResetTokenHash?: TokenHash
 }
 
-const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24
-
 export class InviteManager {
 	constructor(
 		private readonly providers: Providers,
@@ -76,11 +75,11 @@ export class InviteManager {
 					password: passwordWrapper,
 				}))
 				if (method === 'RESET_PASSWORD') {
-					const result = await trx.commandBus.execute(new CreatePasswordResetRequestCommand(person.id, await this.getInviteExpiration(project.slug)))
+					const result = await trx.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)))
 					resetToken = result.token
 				}
 				if (passwordResetTokenHash) {
-					await trx.commandBus.execute(new SavePasswordResetRequestCommand(person.id, passwordResetTokenHash, await this.getInviteExpiration(project.slug)))
+					await trx.commandBus.execute(new SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)))
 				}
 			}
 			for (const membershipUpdate of createAppendMembershipVariables(memberships)) {

package/src/model/service/OtpAuthenticator.ts

@@ -33,7 +33,7 @@ export class OtpAuthenticator {
 	}
 
 	public async create(user: string, label: string): Promise<OtpData> {
-		const secret = new Secret({ buffer: await this.providers.randomBytes(20) })
+		const secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })
 		const totp = new TOTP({
 			label: user,
 			issuer: label,

package/src/model/service/PasswordResetManager.ts

@@ -1,4 +1,3 @@
-import { CreatePasswordResetRequestCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands'
 import { Response, ResponseError } from '../utils/Response'
 import { getPasswordWeaknessMessage } from '../utils/password'
 import { UserMailer } from '../mailing'
@@ -7,6 +6,8 @@ import { PermissionContext } from '../authorization'
 import { ProjectManager } from './ProjectManager'
 import { DatabaseContext } from '../utils'
 import { ImplementationException } from '../../exceptions'
+import { getPreferredProject } from './helpers/getPreferredProject'
+import { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'
 
 interface MailOptions {
 	project?: string
@@ -25,16 +26,9 @@ export class PasswordResetManager {
 		person: PersonRow,
 		mailOptions: MailOptions = {},
 	): Promise<void> {
-		const result = await dbContext.commandBus.execute(new CreatePasswordResetRequestCommand(person.id))
+		const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))
 		const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)
-		const project = (() => {
-			if (projects.length === 1) {
-				return projects[0]
-			} else if (mailOptions.project) {
-				return projects.find(it => it.slug === mailOptions.project) || null
-			}
-			return null
-		})()
+		const project = getPreferredProject(projects, mailOptions.project ?? null)
 		if (!person.email) {
 			throw new ImplementationException()
 		}

package/src/model/service/PasswordlessSignInManager.ts

@@ -0,0 +1,190 @@
+import { ApiKeyManager } from './apiKey'
+import { PersonQuery, PersonRow } from '../queries'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import {
+	ActivatePasswordlessOtpErrorCode,
+	ConfigPolicy,
+	InitSignInPasswordlessErrorCode,
+	InitSignInPasswordlessResult,
+	SignInPasswordlessErrorCode,
+} from '../../schema'
+import { DatabaseContext, validateToken } from '../utils'
+import { ConfigurationManager } from './ConfigurationManager'
+import { UserMailer } from '../mailing'
+import { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'
+import { getPreferredProject } from './helpers/getPreferredProject'
+import { ProjectManager } from './ProjectManager'
+import { PermissionContext } from '../authorization'
+import { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'
+import { ImplementationException } from '../../exceptions'
+import { OtpAuthenticator } from './OtpAuthenticator'
+import { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'
+import { PersonToken } from '../type'
+
+class PasswordlessSignInManager {
+	constructor(
+		private readonly apiKeyManager: ApiKeyManager,
+		private readonly configurationManager: ConfigurationManager,
+		private readonly mailer: UserMailer,
+		private readonly projectManager: ProjectManager,
+		private readonly otpAuthenticator: OtpAuthenticator,
+
+	) {}
+
+	async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {
+		db: DatabaseContext
+		permissionContext: PermissionContext
+		email: string
+		mailVariant?: string
+		mailProject?: string
+	}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {
+		return db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {
+			const configuration = await this.configurationManager.fetchConfiguration(db)
+			if (configuration.passwordless.enabled === 'never') {
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')
+			}
+
+			const person = await db.queryHandler.fetch(PersonQuery.byEmail(email))
+			if (!person) {
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)
+			}
+			if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+			}
+
+			const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)
+			const result = await db.commandBus.execute(createTokenCommand)
+
+
+			const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined
+
+			const projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)
+			const project = getPreferredProject(projects, mailProject ?? null)
+
+			await this.mailer.sendPasswordlessEmail(db, {
+				email,
+				token: result.token,
+				url,
+				project: project?.name,
+				projectSlug: project?.slug,
+			}, {
+				variant: mailVariant || '',
+				projectId: project?.id ?? null,
+			})
+
+			return new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })
+		})
+	}
+
+	private formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {
+		if (!url) {
+			return null
+		}
+		const urlObj = new URL(url)
+		urlObj.searchParams.set('token', token)
+		urlObj.searchParams.set('request_id', requestId)
+		urlObj.searchParams.set('email', email)
+		return urlObj.toString()
+	}
+
+	async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {
+		db: DatabaseContext
+		validationType: PersonToken.ValidationType
+		requestId: string
+		token: string
+		mfaOtp?: string
+		expiration?: number
+	}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {
+		return db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {
+
+			const tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))
+			const tokenValidationResult = validateToken({
+				entry: tokenResult,
+				token,
+				now: db.providers.now(),
+				validationType,
+			})
+			if (!tokenValidationResult.ok) {
+				if (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {
+					await db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))
+				}
+				return tokenValidationResult
+			}
+			const personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))
+			if (!personRow) {
+				throw new ImplementationException()
+			}
+			if (personRow.disabled_at !== null) {
+				return new ResponseError('PERSON_DISABLED', `Person is disabled`)
+			}
+
+			if (personRow.otp_uri && personRow.otp_activated_at) {
+				if (!mfaOtp) {
+					return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
+				}
+
+				if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+					return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
+				}
+			}
+
+			await db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))
+			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
+
+			return new ResponseOk({ person: personRow, token: sessionToken })
+		})
+	}
+
+	async activatePasswordlessOtp({ db, token, requestId, otpHash }: {
+		db: DatabaseContext
+		requestId: string
+		token: string
+		otpHash: string
+	}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {
+		return db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {
+
+			const tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))
+			const tokenValidationResult = validateToken({
+				entry: tokenResult,
+				token,
+				now: db.providers.now(),
+				validationType: 'token',
+			})
+			if (!tokenValidationResult.ok) {
+				return tokenValidationResult
+			}
+
+			await db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))
+
+			return new ResponseOk(null)
+		})
+	}
+
+	private isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {
+		switch (globalValue) {
+			case 'always':
+				return true
+			case 'never':
+				return false
+			case 'optIn':
+				return personValue === true
+			case 'optOut':
+				return personValue !== false
+		}
+	}
+}
+
+namespace PasswordlessSignInManager {
+	export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>
+
+
+	interface SignInPasswordlessResult {
+		readonly person: PersonRow
+		readonly token: string
+	}
+	export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>
+
+	export type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>
+}
+
+export { PasswordlessSignInManager }

package/src/model/service/PersonManager.ts

@@ -3,6 +3,7 @@ import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { PersonQuery, PersonRow } from '../queries'
 import { DatabaseContext } from '../utils'
 import { EmailValidator, EmailValidatorError } from './EmailValidator'
+import { TogglePersonPasswordlessCommand } from '../commands'
 
 class PersonManager {
 	constructor(
@@ -27,6 +28,11 @@ class PersonManager {
 		return new ResponseOk(null)
 	}
 
+	async togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {
+		await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))
+		return new ResponseOk(null)
+	}
+
 }
 
 namespace PersonManager {

package/src/model/service/PersonTokenManager.ts

@@ -0,0 +1,2 @@
+class PersonTokenManager {
+}

package/src/model/service/helpers/getPreferredProject.ts

@@ -0,0 +1,11 @@
+import { Project } from '../../type'
+
+export const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {
+	if (projects.length === 1) {
+		return projects[0]
+	}
+	if (preferredProjectSlug) {
+		return projects.find(it => it.slug === preferredProjectSlug) || null
+	}
+	return null
+}

package/src/model/service/idp/IdentityProviderHandler.ts

@@ -3,17 +3,17 @@ export interface InitIDPAuthResult {
 	sessionData: unknown
 }
 
-export interface IDPClaim {
+export type IDPResponse = {
 	externalIdentifier: string
 	email?: string
 	name?: string
-}
+} & Record<string, unknown>
 
 export interface IdentityProviderHandler<Configuration extends {}> {
 
 	initAuth: (configuration: Configuration, data: unknown) => Promise<InitIDPAuthResult>
 
-	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPClaim>
+	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPResponse>
 
 	validateConfiguration: (config: unknown) => Configuration
 

package/src/model/service/idp/providers/AppleProvider.ts

@@ -1,5 +1,5 @@
 import * as Typesafe from '@contember/typesafe'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'
 import { catchTypesafe } from './helpers'
 import { IDPValidationError } from '../IDPValidationError'
@@ -31,12 +31,12 @@ export class AppleProvider implements IdentityProviderHandler<AppleConfiguration
 		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await initOIDCAuth(client, {
-			claims: configuration.claims,
+			scope: configuration.scope ?? configuration.claims,
 			...initData,
 		})
 	}
 
-	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await handleOIDCResponse(client, responseData)

package/src/model/service/idp/providers/FacebookProvider.ts

@@ -1,6 +1,6 @@
 import * as Typesafe from '@contember/typesafe'
 import { Client, Issuer } from 'openid-client'
-import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 import { IDPValidationError } from '../IDPValidationError'
 import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
 import { catchTypesafe } from './helpers'
@@ -80,12 +80,12 @@ export class FacebookProvider implements IdentityProviderHandler<FacebookConfigu
 		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
 		const client = await this.createOIDCClient(configuration)
 		return await initOIDCAuth(client, {
-			claims: configuration.claims,
+			scope: configuration.scope ?? configuration.claims,
 			...initData,
 		})
 	}
 
-	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPClaim> {
+	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {
 		const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)
 
 		if (!('authResponse' in responseData)) {

package/src/model/service/idp/providers/OIDCHelpers.ts

@@ -2,19 +2,19 @@ import { Client, custom, errors, generators } from 'openid-client'
 import { OIDCResponseData } from './OIDCTypes'
 import { IDPValidationError } from '../IDPValidationError'
 import { IDPResponseError } from '../IDPResponseError'
-import { IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'
 
 custom.setHttpOptionsDefaults({
 	timeout: 5000,
 })
 
-export const initOIDCAuth = async (client: Client, { redirectUrl, claims, responseMode }: { redirectUrl: string; claims?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {
+export const initOIDCAuth = async (client: Client, { redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {
 	const nonce = generators.nonce()
 	const state = generators.state()
 	const url = client.authorizationUrl({
 		redirect_uri: redirectUrl,
 		response_mode: responseMode,
-		scope: claims ?? 'openid email',
+		scope: scope ?? 'openid email',
 		nonce,
 		state,
 	})
@@ -25,7 +25,7 @@ export const initOIDCAuth = async (client: Client, { redirectUrl, claims, respon
 	}
 }
 
-export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPClaim> => {
+export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData, fetchUserInfo?: boolean, returnOIDCResult?: boolean): Promise<IDPResponse> => {
 	const params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)
 	if (params.state && !sessionData?.state) {
 		throw new IDPValidationError(`state is present in parameters, but missing in session data`)
@@ -33,10 +33,15 @@ export const handleOIDCResponse = async (client: Client, { sessionData, redirect
 	try {
 		const result = await client.callback(redirectUrl, params, sessionData)
 		const claims = result.claims()
+		const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims
+		const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}
+		const oidcResult = returnOIDCResult ? result : {}
+		
 		return {
 			externalIdentifier: claims.sub,
-			email: claims.email,
-			name: claims.name,
+			...oidcResult,
+			...claimsWithoutHashes,
+			...userInfo,
 		}
 	} catch (e: any) {
 		if (e instanceof errors.RPError) {