@contember/engine-tenant-api 2.1.0-alpha.3 → 2.1.0-alpha.30

package/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts

@@ -14,7 +14,7 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to update IDP',
 		})
 		const result = await this.idpManager.updateIDP(context.db, args.identityProvider, {
-			configuration: args.configuration,
+			configuration: args.configuration as any,
 			type: args.type ?? undefined,
 			options: {
 				autoSignUp: args.options?.autoSignUp ?? undefined,

package/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts

@@ -1,12 +1,4 @@
-import {
-	ChangeMyPasswordErrorCode,
-	ChangeMyPasswordResponse,
-	ChangePasswordErrorCode,
-	ChangePasswordResponse,
-	MutationChangeMyPasswordArgs,
-	MutationChangePasswordArgs,
-	MutationResolvers,
-} from '../../../schema'
+import { ChangeMyPasswordResponse, ChangePasswordResponse, MutationChangeMyPasswordArgs, MutationChangePasswordArgs, MutationResolvers } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext'
 import { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model'
@@ -33,10 +25,15 @@ export class ChangePasswordMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
 			message: 'You are not allowed to change password',
 		})
-		const result = await this.passwordChangeManager.changePassword(context.db, args.personId, args.password)
+		const response = await this.passwordChangeManager.changePassword(context.db, person, args.password)
+		await context.logAuthAction({
+			type: 'password_change',
+			response,
+			personId: person.id,
+		})
 
-		if (!result.ok) {
-			return createErrorResponse(result.error, result.errorMessage)
+		if (!response.ok) {
+			return createErrorResponse(response)
 		}
 
 		return { ok: true, errors: [] }
@@ -56,10 +53,15 @@ export class ChangePasswordMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_CHANGE_MY_PASSWORD,
 			message: 'You are not allowed to change password',
 		})
-		const result = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)
+		const response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)
+		await context.logAuthAction({
+			type: 'password_change',
+			response: response,
+			personId: person.id,
+		})
 
-		if (!result.ok) {
-			return createErrorResponse(result.error, result.errorMessage)
+		if (!response.ok) {
+			return createErrorResponse(response)
 		}
 
 		return { ok: true }

package/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts

@@ -38,6 +38,12 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 			email: args.email,
 			name: args.name === '' ? null : args.name,
 		})
+		if (args.email) {
+			await context.logAuthAction({
+				type: 'email_change',
+				response: result,
+			})
+		}
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
@@ -70,6 +76,13 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 			email: args.email,
 			name: args.name === '' ? null : args.name,
 		})
+		if (args.email) {
+			await context.logAuthAction({
+				type: 'email_change',
+				response: result,
+				personId: person.id,
+			})
+		}
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)

package/src/resolvers/mutation/person/DisablePersonMutationResolver.ts

@@ -1,8 +1,4 @@
-import {
-	DisablePersonResponse,
-	MutationDisablePersonArgs,
-	MutationResolvers,
-} from '../../../schema'
+import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
 import { PermissionActions, PersonAccessManager } from '../../../model'
 import { PersonManager } from '../../../model/service/PersonManager'
@@ -35,8 +31,12 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to disable person account',
 		})
 
-		const result = await this.personAccessManager.disablePerson(context.db, args.personId)
-
+		const result = await this.personAccessManager.disablePerson(context.db, targetPerson)
+		await context.logAuthAction({
+			type: 'person_disable',
+			response: result,
+			personId: targetPerson.id,
+		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -49,6 +49,10 @@ export class IDPMutationResolver implements MutationResolvers {
 			},
 			args.expiration ?? undefined,
 		)
+		await context.logAuthAction({
+			type: 'idp_login',
+			response: signIn,
+		})
 		if (!signIn.ok) {
 			return createErrorResponse(signIn.error, signIn.errorMessage)
 		}

package/src/resolvers/mutation/person/OtpMutationResolver.ts

@@ -10,6 +10,7 @@ import { TenantResolverContext } from '../../TenantResolverContext'
 import { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'
 import { ImplementationException } from '../../../exceptions'
 import { createErrorResponse } from '../../errorUtils'
+import { ResponseError, ResponseOk } from '../../../model/utils/Response'
 
 export class OtpMutationResolver implements MutationResolvers {
 	constructor(private readonly otpManager: OtpManager) {}
@@ -17,6 +18,13 @@ export class OtpMutationResolver implements MutationResolvers {
 	async prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {
 		const person = await this.getPersonFromContext(context)
 		const otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')
+		if (person.otp_activated_at) {
+			await context.logAuthAction({
+				type: '2fa_disable',
+				response: new ResponseOk(null),
+				personId: person.id,
+			})
+		}
 		return {
 			ok: true,
 			result: {
@@ -35,9 +43,20 @@ export class OtpMutationResolver implements MutationResolvers {
 			)
 		}
 		if (!this.otpManager.verifyOtp(person, args.otpToken)) {
-			return createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')
+			const responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')
+			await context.logAuthAction({
+				type: '2fa_enable',
+				response: responseError,
+				personId: person.id,
+			})
+			return createErrorResponse(responseError)
 		}
 		await this.otpManager.confirmOtp(context.db, person)
+		await context.logAuthAction({
+			type: '2fa_enable',
+			response: new ResponseOk(null),
+			personId: person.id,
+		})
 		return {
 			ok: true,
 			errors: [],
@@ -50,6 +69,11 @@ export class OtpMutationResolver implements MutationResolvers {
 			return createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')
 		}
 		await this.otpManager.disableOtp(context.db, person)
+		await context.logAuthAction({
+			type: '2fa_disable',
+			response: new ResponseOk(null),
+			personId: person.id,
+		})
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/person/PasswordlessMutationResolver.ts

@@ -7,7 +7,7 @@ import {
 	SignInPasswordlessResponse,
 } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions } from '../../../model'
+import { ConfigurationQuery, PermissionActions } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
 import { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'
@@ -34,7 +34,19 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 			mailVariant: args.options?.mailVariant ?? undefined,
 			mailProject: args.options?.mailProject ?? undefined,
 		})
+		await context.logAuthAction({
+			type: 'passwordless_login_init',
+			response: result,
+		})
 		if (!result.ok) {
+			if (result.error === 'PERSON_NOT_FOUND') {
+				const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())
+				if (!configuration.login.revealUserExists) {
+					// If the user does not exist, we don't want to reveal that
+					return createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+				}
+			}
+
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 		return { ok: true, result: result.result }
@@ -53,6 +65,10 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 			validationType: args.validationType,
 			expiration: args.expiration ?? undefined,
 		})
+		await context.logAuthAction({
+			type: 'passwordless_login',
+			response: signIn,
+		})
 		if (!signIn.ok) {
 			return createErrorResponse(signIn.error, signIn.errorMessage)
 		}
@@ -73,6 +89,10 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 			token: args.token,
 			otpHash: args.otpHash,
 		})
+		await context.logAuthAction({
+			type: 'passwordless_login_exchange',
+			response: result,
+		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}

package/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts

@@ -7,8 +7,9 @@ import {
 } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'
+import { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
+import { ResponseError, ResponseOk } from '../../../model/utils/Response'
 
 export class ResetPasswordMutationResolver implements MutationResolvers {
 	constructor(
@@ -28,7 +29,20 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 		})
 		const person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))
 		if (!person) {
-			return createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')
+			const responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)
+			await context.logAuthAction({
+				type: 'password_reset_init',
+				response: responseError,
+				personInput: args.email,
+			})
+
+			const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())
+			if (!configuration.login.revealUserExists) {
+				// If the user does not exist, we do not want to leak this information
+				return { ok: true, errors: [] }
+			}
+
+			return createErrorResponse(responseError)
 		}
 
 		const permissionContext = await this.permissionContextFactory.create(context.db, {
@@ -39,6 +53,12 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 			mailVariant: args.options?.mailVariant || undefined,
 			project: args.options?.mailProject || undefined,
 		})
+		await context.logAuthAction({
+			type: 'password_reset_init',
+			response: new ResponseOk(null),
+			personInput: args.email,
+			personId: person.id,
+		})
 		return { ok: true, errors: [] }
 	}
 
@@ -54,9 +74,13 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 		})
 
 		const result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)
+		await context.logAuthAction({
+			type: 'password_reset',
+			response: result,
+		})
 		if (result.ok) {
 			return { ok: true, errors: [] }
 		}
-		return createErrorResponse(result.error, result.errorMessage)
+		return createErrorResponse(result)
 	}
 }

package/src/resolvers/mutation/person/SignInMutationResolver.ts

@@ -1,15 +1,11 @@
-import {
-	CreateSessionTokenResponse,
-	MutationCreateSessionTokenArgs,
-	MutationResolvers,
-	MutationSignInArgs,
-	SignInResponse,
-} from '../../../schema'
+import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'
+import { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
 import { UserInputError } from '@contember/graphql-utils'
+import { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'
+import { ResponseError } from '../../../model/utils/Response'
 
 export class SignInMutationResolver implements MutationResolvers {
 	constructor(
@@ -23,6 +19,13 @@ export class SignInMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to sign in',
 		})
 
+		const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))
+		if (nextAllowedSignIn > new Date()) {
+			return createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {
+				retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),
+			}))
+		}
+
 		const response = await this.signInManager.signIn(
 			context.db,
 			args.email,
@@ -30,8 +33,18 @@ export class SignInMutationResolver implements MutationResolvers {
 			args.expiration || undefined,
 			args.otpToken || undefined,
 		)
+		await context.logAuthAction({
+			type: 'login',
+			response,
+		})
+
 
 		if (!response.ok) {
+			const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())
+			if (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)) {
+				// if the user does not exist, we don't want to reveal that, so we return a generic error
+				return createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')
+			}
 			return createErrorResponse(response.error, response.errorMessage)
 		}
 
@@ -65,10 +78,15 @@ export class SignInMutationResolver implements MutationResolvers {
 				message: 'You are not allowed to create a session key for this person.',
 			}),
 		)
+		await context.logAuthAction({
+			type: 'create_session_token',
+			response: response,
+		})
 
 		if (!response.ok) {
 			return createErrorResponse(response.error, response.errorMessage)
 		}
+
 		return {
 			ok: true,
 			result: await this.signInResponseFactory.createResponse(response.result, context),

package/src/resolvers/mutation/person/SignUpMutationResolver.ts

@@ -42,7 +42,7 @@ export class SignUpMutationResolver implements MutationResolvers {
 		})
 
 		if (!response.ok) {
-			return createErrorResponse(response.error, response.errorMessage)
+			return createErrorResponse(response)
 		}
 		const result = response.result
 		await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)

package/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts

@@ -1,7 +1,7 @@
 import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'
 import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, PersonManager, PersonQuery } from '../../../model'
+import { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 
 export class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {
@@ -31,7 +31,7 @@ export class TogglePasswordlessMutationResolver implements Pick<MutationResolver
 			action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
 			message: 'You are not allowed to enable passwordless',
 		})
-		const config = await this.configurationManager.fetchConfiguration(context.db)
+		const config = await await context.db.queryHandler.fetch(new ConfigurationQuery())
 		if (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {
 			return createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')
 		}

package/src/resolvers/mutation/project/CreateProjectMutationResolver.ts

@@ -36,7 +36,7 @@ export class CreateProjectMutationResolver implements MutationResolvers {
 			{
 				slug: projectSlug,
 				name: name || projectSlug,
-				config: config || {},
+				config: (config as any) || {},
 				secrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),
 			},
 			{

package/src/resolvers/mutation/project/UpdateProjectMutationResolver.ts

@@ -23,7 +23,7 @@ export class UpdateProjectMutationResolver implements MutationResolvers {
 		}
 		await this.projectManager.updateProject(context.db, project.id, {
 			name: args.name || undefined,
-			config: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config) : undefined,
+			config: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config as any) : undefined,
 		})
 		return { ok: true }
 	}

package/src/resolvers/query/ConfigurationQueryResolver.ts

@@ -1,5 +1,5 @@
 import { Config, QueryResolvers } from '../../schema'
-import { PermissionActions } from '../../model'
+import { ConfigurationQuery, PermissionActions } from '../../model'
 import { TenantResolverContext } from '../TenantResolverContext'
 import { ConfigurationManager } from '../../model/service/ConfigurationManager'
 
@@ -16,6 +16,6 @@ export class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configu
 			message: 'You are not allowed to view configuration',
 		})
 
-		return await this.configurationManager.fetchConfiguration(context.db)
+		return await context.db.queryHandler.fetch(new ConfigurationQuery())
 	}
 }

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -12,7 +12,7 @@ export class ProjectTypeResolver implements ProjectResolvers {
 	) {}
 
 	async members(
-		parent: Project,
+		parent: Omit<Project, 'config'>,
 		args: ProjectMembersArgs,
 		context: TenantResolverContext,
 	): Promise<readonly ProjectIdentityRelation[]> {
@@ -38,7 +38,7 @@ export class ProjectTypeResolver implements ProjectResolvers {
 		}))
 	}
 
-	async roles(parent: Project, args: unknown, context: TenantResolverContext) {
+	async roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {
 		const schema = await this.projectSchemaResolver.getSchema(parent.slug)
 		if (!schema) {
 			return []