@contember/engine-tenant-api 2.1.0-alpha.30 → 2.1.0-alpha.35

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.cjs

@@ -1,73 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-class IDPMutationResolver {
-  constructor(idpSignInManager, signInResponseFactory) {
-    this.idpSignInManager = idpSignInManager;
-    this.signInResponseFactory = signInResponseFactory;
-  }
-  async initSignInIDP(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_CREATE_IDP_URL,
-      message: "You are not allowed to create a redirect URL for IDP"
-    });
-    const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {
-      redirectUrl: args.redirectUrl
-    });
-    if (!result.ok) {
-      return errorUtils.createErrorResponse(result.error, result.errorMessage);
-    }
-    return { ok: true, errors: [], result: result.result };
-  }
-  async signInIDP(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_SIGN_IN_IDP,
-      message: "You are not allowed to person IDP sign in"
-    });
-    const signIn = await this.idpSignInManager.signInIDP(
-      context.db,
-      args.identityProvider,
-      args.data ?? {
-        sessionData: args.sessionData,
-        url: args.idpResponse?.url,
-        redirectUrl: args.redirectUrl
-      },
-      args.expiration ?? void 0
-    );
-    await context.logAuthAction({
-      type: "idp_login",
-      response: signIn
-    });
-    if (!signIn.ok) {
-      return errorUtils.createErrorResponse(signIn.error, signIn.errorMessage);
-    }
-    return {
-      ok: true,
-      errors: [],
-      result: {
-        ...await this.signInResponseFactory.createResponse(signIn.result, context),
-        idpResponse: signIn.result.idpResponse
-      }
-    };
-  }
-}
-exports.IDPMutationResolver = IDPMutationResolver;
-//# sourceMappingURL=IDPMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAGtD,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IACpB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.js

@@ -1,73 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createErrorResponse } from "../../errorUtils.js";
-class IDPMutationResolver {
-  constructor(idpSignInManager, signInResponseFactory) {
-    this.idpSignInManager = idpSignInManager;
-    this.signInResponseFactory = signInResponseFactory;
-  }
-  async initSignInIDP(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.PERSON_CREATE_IDP_URL,
-      message: "You are not allowed to create a redirect URL for IDP"
-    });
-    const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {
-      redirectUrl: args.redirectUrl
-    });
-    if (!result.ok) {
-      return createErrorResponse(result.error, result.errorMessage);
-    }
-    return { ok: true, errors: [], result: result.result };
-  }
-  async signInIDP(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.PERSON_SIGN_IN_IDP,
-      message: "You are not allowed to person IDP sign in"
-    });
-    const signIn = await this.idpSignInManager.signInIDP(
-      context.db,
-      args.identityProvider,
-      args.data ?? {
-        sessionData: args.sessionData,
-        url: args.idpResponse?.url,
-        redirectUrl: args.redirectUrl
-      },
-      args.expiration ?? void 0
-    );
-    await context.logAuthAction({
-      type: "idp_login",
-      response: signIn
-    });
-    if (!signIn.ok) {
-      return createErrorResponse(signIn.error, signIn.errorMessage);
-    }
-    return {
-      ok: true,
-      errors: [],
-      result: {
-        ...await this.signInResponseFactory.createResponse(signIn.result, context),
-        idpResponse: signIn.result.idpResponse
-      }
-    };
-  }
-}
-export {
-  IDPMutationResolver
-};
-//# sourceMappingURL=IDPMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IDPSignInManager, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {\n\t\t\tredirectUrl: args.redirectUrl,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB,cAAc,QAAQ,IAAI,KAAK,kBAAkB,KAAK,QAAQ;AAAA,MACxG,aAAa,KAAK;AAAA,IAAA,CAClB;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAGtD,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,cAAc;AAAA,IACpB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs

@@ -1,98 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-const token = require("../../../model/utils/token.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const membershipUtils = require("../../membershipUtils.cjs");
-const errorUtils = require("../../errorUtils.cjs");
-const graphqlUtils = require("@contember/graphql-utils");
-const PersonResponseFactory = require("../../responseHelpers/PersonResponseFactory.cjs");
-class InviteMutationResolver {
-  constructor(inviteManager, projectManager, membershipValidator) {
-    this.inviteManager = inviteManager;
-    this.projectManager = projectManager;
-    this.membershipValidator = membershipValidator;
-  }
-  async invite(parent, { projectSlug, email, name, memberships, options }, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
-    await context.requireAccess({
-      scope: await context.permissionContext.createProjectScope(project),
-      action: PermissionActions.PermissionActions.PERSON_INVITE(memberships),
-      message: "You are not allowed to invite a person"
-    });
-    if (!project) {
-      return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
-    }
-    return this.doInvite(context.db, {
-      email,
-      project,
-      memberships,
-      name: name ?? void 0,
-      emailVariant: options?.mailVariant || "",
-      method: options?.method ?? "CREATE_PASSWORD"
-    });
-  }
-  async unmanagedInvite(parent, { projectSlug, email, memberships, password, options }, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
-    await context.requireAccess({
-      scope: await context.permissionContext.createProjectScope(project),
-      action: PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED(memberships),
-      message: "You are not allowed to unmanaged person invite"
-    });
-    if (!project) {
-      return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
-    }
-    if (typeof options?.resetTokenHash === "string" && !token.isTokenHash(options?.resetTokenHash)) {
-      throw new graphqlUtils.UserInputError("Invalid format of resetTokenHash. Must be hex-encoded sha256.");
-    }
-    return this.doInvite(context.db, {
-      email,
-      project,
-      memberships,
-      noEmail: true,
-      password: password ?? options?.password ?? void 0,
-      passwordResetTokenHash: options?.resetTokenHash ?? void 0
-    });
-  }
-  async doInvite(dbContext, invite) {
-    const validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships);
-    if (validationResult.length > 0) {
-      const errors = membershipUtils.createMembershipValidationErrorResult(validationResult);
-      return {
-        ok: false,
-        errors,
-        error: errors[0]
-      };
-    }
-    const response = await this.inviteManager.invite(dbContext, invite);
-    if (!response.ok) {
-      return errorUtils.createErrorResponse(response.error, response.errorMessage);
-    }
-    const result = response.result;
-    return {
-      ok: true,
-      errors: [],
-      result: {
-        person: PersonResponseFactory.PersonResponseFactory.createPersonResponse(result.person),
-        isNew: result.isNew
-      }
-    };
-  }
-}
-exports.InviteMutationResolver = InviteMutationResolver;
-//# sourceMappingURL=InviteMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAE/D,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EAAA;AAAA,EAGF,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAAC,WAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAElE,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAACC,kBAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAIC,4BAAe,+DAA+D;AAAA,IAAA;AAElF,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EAAA;AAAA,EAGF,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAASC,sDAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAChB;AAAA,IAAA;AAED,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IAEhB;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js

@@ -1,98 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import { isTokenHash } from "../../../model/utils/token.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
-import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
-import { UserInputError } from "@contember/graphql-utils";
-import { PersonResponseFactory } from "../../responseHelpers/PersonResponseFactory.js";
-class InviteMutationResolver {
-  constructor(inviteManager, projectManager, membershipValidator) {
-    this.inviteManager = inviteManager;
-    this.projectManager = projectManager;
-    this.membershipValidator = membershipValidator;
-  }
-  async invite(parent, { projectSlug, email, name, memberships, options }, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
-    await context.requireAccess({
-      scope: await context.permissionContext.createProjectScope(project),
-      action: PermissionActions.PERSON_INVITE(memberships),
-      message: "You are not allowed to invite a person"
-    });
-    if (!project) {
-      return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
-    }
-    return this.doInvite(context.db, {
-      email,
-      project,
-      memberships,
-      name: name ?? void 0,
-      emailVariant: options?.mailVariant || "",
-      method: options?.method ?? "CREATE_PASSWORD"
-    });
-  }
-  async unmanagedInvite(parent, { projectSlug, email, memberships, password, options }, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
-    await context.requireAccess({
-      scope: await context.permissionContext.createProjectScope(project),
-      action: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),
-      message: "You are not allowed to unmanaged person invite"
-    });
-    if (!project) {
-      return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
-    }
-    if (typeof options?.resetTokenHash === "string" && !isTokenHash(options?.resetTokenHash)) {
-      throw new UserInputError("Invalid format of resetTokenHash. Must be hex-encoded sha256.");
-    }
-    return this.doInvite(context.db, {
-      email,
-      project,
-      memberships,
-      noEmail: true,
-      password: password ?? options?.password ?? void 0,
-      passwordResetTokenHash: options?.resetTokenHash ?? void 0
-    });
-  }
-  async doInvite(dbContext, invite) {
-    const validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships);
-    if (validationResult.length > 0) {
-      const errors = createMembershipValidationErrorResult(validationResult);
-      return {
-        ok: false,
-        errors,
-        error: errors[0]
-      };
-    }
-    const response = await this.inviteManager.invite(dbContext, invite);
-    if (!response.ok) {
-      return createErrorResponse(response.error, response.errorMessage);
-    }
-    const result = response.result;
-    return {
-      ok: true,
-      errors: [],
-      result: {
-        person: PersonResponseFactory.createPersonResponse(result.person),
-        isNew: result.isNew
-      }
-    };
-  }
-}
-export {
-  InviteMutationResolver
-};
-//# sourceMappingURL=InviteMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tDatabaseContext,\n\tInviteData,\n\tInviteManager,\n\tisTokenHash,\n\tMembershipValidator,\n\tPermissionActions,\n\tProjectManager,\n} from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAQ,GACjD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAE/D,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EAAA;AAAA,EAGF,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAQ,GACrD,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACN,aAAA,8BAA8B,qBAAqB,WAAW;AAAA,IAAA;AAElE,QAAA,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACnF,YAAA,IAAI,eAAe,+DAA+D;AAAA,IAAA;AAElF,WAAA,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EAAA;AAAA,EAGF,MAAc,SACb,WACA,QAC0B;AACpB,UAAA,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACpG,QAAA,iBAAiB,SAAS,GAAG;AAC1B,YAAA,SAAS,sCAAsC,gBAAgB;AAC9D,aAAA;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAChB;AAAA,IAAA;AAED,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAE9D,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAEjE,UAAM,SAAS,SAAS;AAEjB,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IAEhB;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs

@@ -1,104 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-const exceptions = require("../../../exceptions.cjs");
-const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-class OtpMutationResolver {
-  constructor(otpManager) {
-    this.otpManager = otpManager;
-  }
-  async prepareOtp(parent, args, context) {
-    const person = await this.getPersonFromContext(context);
-    const otp = await this.otpManager.prepareOtp(context.db, person, args.label || "Contember");
-    if (person.otp_activated_at) {
-      await context.logAuthAction({
-        type: "2fa_disable",
-        response: new Response.ResponseOk(null),
-        personId: person.id
-      });
-    }
-    return {
-      ok: true,
-      result: {
-        otpUri: otp.uri,
-        otpSecret: otp.secret
-      }
-    };
-  }
-  async confirmOtp(parent, args, context) {
-    const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
-      return errorUtils.createErrorResponse(
-        "NOT_PREPARED",
-        `OTP setup was not initialized. Call prepareOtp first.`
-      );
-    }
-    if (!this.otpManager.verifyOtp(person, args.otpToken)) {
-      const responseError = new Response.ResponseError("INVALID_OTP_TOKEN", "Provided token is not correct.");
-      await context.logAuthAction({
-        type: "2fa_enable",
-        response: responseError,
-        personId: person.id
-      });
-      return errorUtils.createErrorResponse(responseError);
-    }
-    await this.otpManager.confirmOtp(context.db, person);
-    await context.logAuthAction({
-      type: "2fa_enable",
-      response: new Response.ResponseOk(null),
-      personId: person.id
-    });
-    return {
-      ok: true,
-      errors: []
-    };
-  }
-  async disableOtp(parent, args, context) {
-    const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
-      return errorUtils.createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot disable it.");
-    }
-    await this.otpManager.disableOtp(context.db, person);
-    await context.logAuthAction({
-      type: "2fa_disable",
-      response: new Response.ResponseOk(null),
-      personId: person.id
-    });
-    return {
-      ok: true,
-      errors: []
-    };
-  }
-  async getPersonFromContext(context) {
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_SETUP_OTP,
-      message: "You are not allowed to setup a OTP"
-    });
-    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      throw new exceptions.ImplementationException("Person should exists");
-    }
-    return person;
-  }
-}
-exports.OtpMutationResolver = OtpMutationResolver;
-//# sourceMappingURL=OtpMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\tif (person.otp_activated_at) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_disable',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["ResponseOk","createErrorResponse","ResponseError","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,QAAI,OAAO,kBAAkB;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIA,SAAA,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEK,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAC,WAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AACtD,YAAM,gBAAgB,IAAIC,uBAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAOD,WAAAA,oBAAoB,aAAa;AAAA,IAAA;AAEzC,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAID,SAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACM,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAC,WAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAID,SAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACM,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAIC,mCAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js

@@ -1,104 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import { ImplementationException } from "../../../exceptions.js";
-import { ResponseOk, ResponseError } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createErrorResponse } from "../../errorUtils.js";
-class OtpMutationResolver {
-  constructor(otpManager) {
-    this.otpManager = otpManager;
-  }
-  async prepareOtp(parent, args, context) {
-    const person = await this.getPersonFromContext(context);
-    const otp = await this.otpManager.prepareOtp(context.db, person, args.label || "Contember");
-    if (person.otp_activated_at) {
-      await context.logAuthAction({
-        type: "2fa_disable",
-        response: new ResponseOk(null),
-        personId: person.id
-      });
-    }
-    return {
-      ok: true,
-      result: {
-        otpUri: otp.uri,
-        otpSecret: otp.secret
-      }
-    };
-  }
-  async confirmOtp(parent, args, context) {
-    const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
-      return createErrorResponse(
-        "NOT_PREPARED",
-        `OTP setup was not initialized. Call prepareOtp first.`
-      );
-    }
-    if (!this.otpManager.verifyOtp(person, args.otpToken)) {
-      const responseError = new ResponseError("INVALID_OTP_TOKEN", "Provided token is not correct.");
-      await context.logAuthAction({
-        type: "2fa_enable",
-        response: responseError,
-        personId: person.id
-      });
-      return createErrorResponse(responseError);
-    }
-    await this.otpManager.confirmOtp(context.db, person);
-    await context.logAuthAction({
-      type: "2fa_enable",
-      response: new ResponseOk(null),
-      personId: person.id
-    });
-    return {
-      ok: true,
-      errors: []
-    };
-  }
-  async disableOtp(parent, args, context) {
-    const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
-      return createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot disable it.");
-    }
-    await this.otpManager.disableOtp(context.db, person);
-    await context.logAuthAction({
-      type: "2fa_disable",
-      response: new ResponseOk(null),
-      personId: person.id
-    });
-    return {
-      ok: true,
-      errors: []
-    };
-  }
-  async getPersonFromContext(context) {
-    await context.requireAccess({
-      action: PermissionActions.PERSON_SETUP_OTP,
-      message: "You are not allowed to setup a OTP"
-    });
-    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      throw new ImplementationException("Person should exists");
-    }
-    return person;
-  }
-}
-export {
-  OtpMutationResolver
-};
-//# sourceMappingURL=OtpMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\tif (person.otp_activated_at) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_disable',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,QAAI,OAAO,kBAAkB;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEK,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AACtD,YAAM,gBAAgB,IAAI,cAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAO,oBAAoB,aAAa;AAAA,IAAA;AAEzC,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACM,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACM,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,wBAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;"}