@contember/engine-tenant-api 2.1.0-alpha.1 → 2.1.0-alpha.11

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import {\n\tDisablePersonResponse,\n\tMutationDisablePersonArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, args.personId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,8BAA2D;AAAA,EAEvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QAAa,MAAiC,SACb;AAC3B,UAAA,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AACnB,aAAA;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAE5C;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAEjF,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAGtD,WAAA;AAAA,MACN,IAAI;AAAA,IACL;AAAA,EAAA;AAEF;;"}
+{"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import {\n\tDisablePersonResponse,\n\tMutationDisablePersonArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, args.personId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;AAUO,MAAM,8BAA2D;AAAA,EAEvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QAAa,MAAiC,SACb;AAC3B,UAAA,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AACnB,aAAA;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAE5C;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAEjF,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAGtD,WAAA;AAAA,MACN,IAAI;AAAA,IACL;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.js

@@ -12,7 +12,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import {\n\tDisablePersonResponse,\n\tMutationDisablePersonArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, args.personId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAUO,MAAM,8BAA2D;AAAA,EAEvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QAAa,MAAiC,SACb;AAC3B,UAAA,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AACnB,aAAA;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAE5C;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAEjF,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAGtD,WAAA;AAAA,MACN,IAAI;AAAA,IACL;AAAA,EAAA;AAEF;"}
+{"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import {\n\tDisablePersonResponse,\n\tMutationDisablePersonArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, args.personId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAUO,MAAM,8BAA2D;AAAA,EAEvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QAAa,MAAiC,SACb;AAC3B,UAAA,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AACnB,aAAA;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAE5C;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAEjF,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAGtD,WAAA;AAAA,MACN,IAAI;AAAA,IACL;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.cjs

@@ -14,7 +14,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAGtD,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IACpB;AACI,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEF;;"}
+{"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAGtD,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IACpB;AACI,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.js

@@ -12,7 +12,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAGtD,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IACpB;AACI,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEF;"}
+{"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAGtD,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IACpB;AACI,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs

@@ -14,7 +14,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAE/D,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EAAA;AAAA,EAGF,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAElE,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAACC,uBAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAIC,4BAAe,+DAA+D;AAAA,IAAA;AAElF,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EAAA;AAAA,EAGF,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAASC,sDAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAChB;AAAA,IAAA;AAED,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IAEhB;AAAA,EAAA;AAEF;;"}
+{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAE/D,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EAAA;AAAA,EAGF,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAElE,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAACC,uBAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAIC,4BAAe,+DAA+D;AAAA,IAAA;AAElF,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EAAA;AAAA,EAGF,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAASC,sDAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAChB;AAAA,IAAA;AAED,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IAEhB;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js

@@ -12,7 +12,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAE/D,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EAAA;AAAA,EAGF,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAElE,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAI,eAAe,+DAA+D;AAAA,IAAA;AAElF,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EAAA;AAAA,EAGF,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAAS,sCAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAChB;AAAA,IAAA;AAED,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IAEhB;AAAA,EAAA;AAEF;"}
+{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAE/D,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EAAA;AAAA,EAGF,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAElE,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAI,eAAe,+DAA+D;AAAA,IAAA;AAElF,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EAAA;AAAA,EAGF,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAAS,sCAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAChB;AAAA,IAAA;AAED,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IAEhB;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs

@@ -16,7 +16,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AACnF,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAA,WAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AAC/C,aAAAA,WAAA,oBAAoB,qBAAqB,gCAAgC;AAAA,IAAA;AAEjF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAA,WAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAIC,mCAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;;"}
+{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AACnF,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAA,WAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AAC/C,aAAAA,WAAA,oBAAoB,qBAAqB,gCAAgC;AAAA,IAAA;AAEjF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAA,WAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAIC,mCAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js

@@ -14,7 +14,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AACnF,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AAC/C,aAAA,oBAAoB,qBAAqB,gCAAgC;AAAA,IAAA;AAEjF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,wBAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;"}
+{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AACnF,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AAC/C,aAAA,oBAAoB,qBAAqB,gCAAgC;AAAA,IAAA;AAEjF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,wBAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs

@@ -14,7 +14,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,6BAA6I;AAAA,EACzJ,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAE7D,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAG1C,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAC/E;AAAA,EAAA;AAAA,EAGD,MAAM,wBAAwB,QAAa,MAA2C,SAA0E;AAC/J,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAEpB;;"}
+{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;AAcO,MAAM,6BAA6I;AAAA,EACzJ,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAE7D,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAG1C,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAC/E;AAAA,EAAA;AAAA,EAGD,MAAM,wBAAwB,QAAa,MAA2C,SAA0E;AAC/J,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAEpB;;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js

@@ -12,7 +12,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAcO,MAAM,6BAA6I;AAAA,EACzJ,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAE7D,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAG1C,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAC/E;AAAA,EAAA;AAAA,EAGD,MAAM,wBAAwB,QAAa,MAA2C,SAA0E;AAC/J,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAEpB;"}
+{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,6BAA6I;AAAA,EACzJ,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAE7D,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAG1C,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAC/E;AAAA,EAAA;AAAA,EAGD,MAAM,wBAAwB,QAAa,MAA2C,SAA0E;AAC/J,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAEpB;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs

@@ -15,7 +15,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,oBAAoB,uBAAuB;AAAA,IAAA;AAGvE,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAAA,EAG/B,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,IAAA;AAE/B,WAAOE,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,EAAA;AAE9D;;"}
+{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,oBAAoB,uBAAuB;AAAA,IAAA;AAGvE,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAAA,EAG/B,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,IAAA;AAE/B,WAAOE,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,EAAA;AAE9D;;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js

@@ -13,7 +13,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,oBAAoB,uBAAuB;AAAA,IAAA;AAGvE,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAAA,EAG/B,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,IAAA;AAE/B,WAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,EAAA;AAE9D;"}
+{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,oBAAoB,uBAAuB;AAAA,IAAA;AAGvE,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAAA,EAG/B,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,IAAA;AAE/B,WAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,EAAA;AAE9D;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs

@@ -14,7 +14,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,oCAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAIE,aAAAA,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQF,kBAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAE1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;;"}
+{"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,oCAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAIE,aAAAA,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQF,kBAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAE1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js

@@ -12,7 +12,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAaO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAE1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}
+{"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAaO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AAEI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAE1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.cjs

@@ -15,7 +15,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","ApiKey","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AACzG,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,gBAAgB,4BAA4B;AAAA,IAAA;AAGlE,UAAA,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAASC,cAAO,KAAK,WAAW;AAC5C,aAAAD,WAAA;AAAA,QACN;AAAA,QAAgD;AAAA,MACjD;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAAA,OACzE;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAAA;AAGpE,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAEhC;;"}
+{"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","ApiKey","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AACzG,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,gBAAgB,4BAA4B;AAAA,IAAA;AAGlE,UAAA,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAASC,cAAO,KAAK,WAAW;AAC5C,aAAAD,WAAA;AAAA,QACN;AAAA,QAAgD;AAAA,MACjD;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAAA,OACzE;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAAA;AAGpE,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAEhC;;"}

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.js

@@ -13,7 +13,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AACzG,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,gBAAgB,4BAA4B;AAAA,IAAA;AAGlE,UAAA,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAAS,OAAO,KAAK,WAAW;AAC5C,aAAA;AAAA,QACN;AAAA,QAAgD;AAAA,MACjD;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAAA,OACzE;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAAA;AAGpE,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAEhC;"}
+{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AACzG,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,gBAAgB,4BAA4B;AAAA,IAAA;AAGlE,UAAA,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAAS,OAAO,KAAK,WAAW;AAC5C,aAAA;AAAA,QACN;AAAA,QAAgD;AAAA,MACjD;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAAA,OACzE;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAAA;AAGpE,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAEhC;"}

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.cjs

@@ -15,7 +15,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tApiKeyManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tSignUpManager,\n} from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","PasswordPlain","UserInputError","PasswordHash","NoPassword","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE5E,MAAM,OAAO,QAAa,MAA0B,SAAyD;AACtG,UAAA,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AACX,eAAA,IAAIC,SAAAA,cAAc,KAAK,QAAQ;AAAA,MAAA;AAEvC,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AACpC,gBAAA,IAAIC,4BAAe,8DAA8D;AAAA,QAAA;AAEjF,eAAA,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAAA;AAEnC,aAAAC,SAAA;AAAA,IAAA,GACL;AAEH,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAElE,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IAElE;AAAA,EAAA;AAEF;;"}
+{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tApiKeyManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tSignUpManager,\n} from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","PasswordPlain","UserInputError","PasswordHash","NoPassword","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE5E,MAAM,OAAO,QAAa,MAA0B,SAAyD;AACtG,UAAA,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AACX,eAAA,IAAIC,SAAAA,cAAc,KAAK,QAAQ;AAAA,MAAA;AAEvC,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AACpC,gBAAA,IAAIC,4BAAe,8DAA8D;AAAA,QAAA;AAEjF,eAAA,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAAA;AAEnC,aAAAC,SAAA;AAAA,IAAA,GACL;AAEH,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAElE,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IAElE;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.js

@@ -13,7 +13,6 @@ import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/OIDCHelpers.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "@contember/schema-utils";
 import "otpauth";

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tApiKeyManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tSignUpManager,\n} from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE5E,MAAM,OAAO,QAAa,MAA0B,SAAyD;AACtG,UAAA,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AACX,eAAA,IAAI,cAAc,KAAK,QAAQ;AAAA,MAAA;AAEvC,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AACpC,gBAAA,IAAI,eAAe,8DAA8D;AAAA,QAAA;AAEjF,eAAA,IAAI,aAAa,KAAK,YAAY;AAAA,MAAA;AAEnC,aAAA;AAAA,IAAA,GACL;AAEH,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAElE,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IAElE;AAAA,EAAA;AAEF;"}
+{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tApiKeyManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tSignUpManager,\n} from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE5E,MAAM,OAAO,QAAa,MAA0B,SAAyD;AACtG,UAAA,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AACX,eAAA,IAAI,cAAc,KAAK,QAAQ;AAAA,MAAA;AAEvC,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AACpC,gBAAA,IAAI,eAAe,8DAA8D;AAAA,QAAA;AAEjF,eAAA,IAAI,aAAa,KAAK,YAAY;AAAA,MAAA;AAEnC,aAAA;AAAA,IAAA,GACL;AAEH,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAElE,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IAElE;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs

@@ -15,7 +15,6 @@ require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/OIDCHelpers.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("@contember/schema-utils");
 require("otpauth");