@contember/engine-tenant-api 2.1.0-alpha.18 → 2.1.0-alpha.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs +1 -1
  2. package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs.map +1 -1
  3. package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js +1 -1
  4. package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js.map +1 -1
  5. package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.cjs +1 -1
  6. package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.cjs.map +1 -1
  7. package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.js +1 -1
  8. package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.js.map +1 -1
  9. package/dist/types/tsconfig.tsbuildinfo +1 -1
  10. package/package.json +12 -12
  11. package/src/resolvers/mutation/person/SignInMutationResolver.ts +1 -1
package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs CHANGED
@@ -52,7 +52,7 @@ class SignInMutationResolver {
52
52
  });
53
53
  if (!response.ok) {
54
54
  const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
55
- if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD"].includes(response.error)) {
55
+ if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
56
56
  return errorUtils.createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
57
57
  }
58
58
  return errorUtils.createErrorResponse(response.error, response.errorMessage);
package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","NextLoginAttemptQuery","createErrorResponse","ResponseError","ConfigurationQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAA,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAOC,WAAoB,oBAAA,IAAIC,SAAAA,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK,GAAG;AAE7I,eAAAF,WAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAOA,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,oCAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQL,kBAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;;"}
1
+ {"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","NextLoginAttemptQuery","createErrorResponse","ResponseError","ConfigurationQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAA,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAOC,WAAoB,oBAAA,IAAIC,SAAAA,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK,GAAG;AAE9J,eAAAF,WAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAOA,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,oCAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQL,kBAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;;"}
package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js CHANGED
@@ -50,7 +50,7 @@ class SignInMutationResolver {
50
50
  });
51
51
  if (!response.ok) {
52
52
  const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
53
- if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD"].includes(response.error)) {
53
+ if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
54
54
  return createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
55
55
  }
56
56
  return createErrorResponse(response.error, response.errorMessage);
package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAO,oBAAoB,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK,GAAG;AAE7I,eAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}
1
+ {"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAO,oBAAoB,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK,GAAG;AAE9J,eAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}
package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.cjs CHANGED
@@ -52,7 +52,7 @@ class SignInMutationResolver {
52
52
  });
53
53
  if (!response.ok) {
54
54
  const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
55
- if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD"].includes(response.error)) {
55
+ if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
56
56
  return errorUtils.createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
57
57
  }
58
58
  return errorUtils.createErrorResponse(response.error, response.errorMessage);
package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","NextLoginAttemptQuery","createErrorResponse","ResponseError","ConfigurationQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAA,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAOC,WAAoB,oBAAA,IAAIC,SAAAA,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK,GAAG;AAE7I,eAAAF,WAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAOA,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,oCAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQL,kBAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;;"}
1
+ {"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","NextLoginAttemptQuery","createErrorResponse","ResponseError","ConfigurationQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAA,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAOC,WAAoB,oBAAA,IAAIC,SAAAA,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK,GAAG;AAE9J,eAAAF,WAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAOA,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,oCAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQL,kBAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;;"}
package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.js CHANGED
@@ -50,7 +50,7 @@ class SignInMutationResolver {
50
50
  });
51
51
  if (!response.ok) {
52
52
  const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
53
- if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD"].includes(response.error)) {
53
+ if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
54
54
  return createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
55
55
  }
56
56
  return createErrorResponse(response.error, response.errorMessage);
package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAO,oBAAoB,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK,GAAG;AAE7I,eAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}
1
+ {"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAO,oBAAoB,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK,GAAG;AAE9J,eAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}