@contember/engine-tenant-api 2.1.0-alpha.30 → 2.1.0-alpha.36

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t}))\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists && ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person => await context.requireAccess({\n\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AAC/F,QAAA,oBAAwB,oBAAA,QAAQ;AACnC,aAAO,oBAAoB,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,QACjH,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,MAAA,CACvE,CAAC;AAAA,IAAA;AAGG,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAClB;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAGG,QAAA,CAAC,SAAS,IAAI;AACX,YAAA,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,oBAAoB,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK,GAAG;AAE9J,eAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MAAA;AAExE,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAAA,EAGD,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,MACpD,SAAS;AAAA,IAAA,CACT;AACG,QAAA;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAM;AAAA,IAAA,WACtC,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAAA,OACvC;AACA,YAAA,IAAI,eAAe,yCAAyC;AAAA,IAAA;AAG7D,UAAA,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WAAU,MAAM,QAAQ,cAAc;AAAA,QAC3C,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MACT,CAAA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAG1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IACjF;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.cjs

@@ -1,52 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-const ApiKey = require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-class SignOutMutationResolver {
-  constructor(apiKeyManager) {
-    this.apiKeyManager = apiKeyManager;
-  }
-  async signOut(parent, args, context) {
-    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      return errorUtils.createErrorResponse("NOT_A_PERSON", "Only a person can sign out");
-    }
-    const personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId);
-    if (personApiKeyId?.type === ApiKey.ApiKey.Type.PERMANENT) {
-      return errorUtils.createErrorResponse(
-        "NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY",
-        "Only session API keys can be used for person sign out."
-      );
-    }
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_SIGN_OUT,
-      message: "You are not allowed to sign out"
-    });
-    if (args.all) {
-      await this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id);
-    } else {
-      await this.apiKeyManager.disableApiKey(context.db, context.apiKeyId);
-    }
-    return { ok: true, errors: [] };
-  }
-}
-exports.SignOutMutationResolver = SignOutMutationResolver;
-//# sourceMappingURL=SignOutMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","ApiKey","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AACzG,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,gBAAgB,4BAA4B;AAAA,IAAA;AAGlE,UAAA,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAASC,cAAO,KAAK,WAAW;AAC5C,aAAAD,WAAA;AAAA,QACN;AAAA,QAAgD;AAAA,MACjD;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAAA,OACzE;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAAA;AAGpE,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAEhC;;"}

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.js

@@ -1,52 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import { ApiKey } from "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createErrorResponse } from "../../errorUtils.js";
-class SignOutMutationResolver {
-  constructor(apiKeyManager) {
-    this.apiKeyManager = apiKeyManager;
-  }
-  async signOut(parent, args, context) {
-    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      return createErrorResponse("NOT_A_PERSON", "Only a person can sign out");
-    }
-    const personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId);
-    if (personApiKeyId?.type === ApiKey.Type.PERMANENT) {
-      return createErrorResponse(
-        "NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY",
-        "Only session API keys can be used for person sign out."
-      );
-    }
-    await context.requireAccess({
-      action: PermissionActions.PERSON_SIGN_OUT,
-      message: "You are not allowed to sign out"
-    });
-    if (args.all) {
-      await this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id);
-    } else {
-      await this.apiKeyManager.disableApiKey(context.db, context.apiKeyId);
-    }
-    return { ok: true, errors: [] };
-  }
-}
-export {
-  SignOutMutationResolver
-};
-//# sourceMappingURL=SignOutMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AACzG,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,gBAAgB,4BAA4B;AAAA,IAAA;AAGlE,UAAA,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAAS,OAAO,KAAK,WAAW;AAC5C,aAAA;AAAA,QACN;AAAA,QAAgD;AAAA,MACjD;AAAA,IAAA;AAGD,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAAA,OACzE;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAAA;AAGpE,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAEhC;"}

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.cjs

@@ -1,69 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-const Password = require("../../../model/dtos/Password.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-const graphqlUtils = require("@contember/graphql-utils");
-const PersonResponseFactory = require("../../responseHelpers/PersonResponseFactory.cjs");
-class SignUpMutationResolver {
-  constructor(signUpManager, apiKeyManager) {
-    this.signUpManager = signUpManager;
-    this.apiKeyManager = apiKeyManager;
-  }
-  async signUp(parent, args, context) {
-    const roles = args.roles ?? [];
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_SIGN_UP(roles),
-      message: "You are not allowed to sign up"
-    });
-    const password = (() => {
-      if (args.password) {
-        return new Password.PasswordPlain(args.password);
-      }
-      if (args.passwordHash) {
-        if (!args.passwordHash.startsWith("$2b$")) {
-          throw new graphqlUtils.UserInputError("Invalid password hash. Only $2b$ bcrypt hashes are accepted.");
-        }
-        return new Password.PasswordHash(args.passwordHash);
-      }
-      return Password.NoPassword;
-    })();
-    const response = await this.signUpManager.signUp(context.db, {
-      email: args.email,
-      name: args.name ?? void 0,
-      password,
-      roles
-    });
-    if (!response.ok) {
-      return errorUtils.createErrorResponse(response);
-    }
-    const result = response.result;
-    await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId);
-    return {
-      ok: true,
-      errors: [],
-      result: {
-        person: PersonResponseFactory.PersonResponseFactory.createPersonResponse(result.person)
-      }
-    };
-  }
-}
-exports.SignUpMutationResolver = SignUpMutationResolver;
-//# sourceMappingURL=SignUpMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tApiKeyManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tSignUpManager,\n} from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","PasswordPlain","UserInputError","PasswordHash","NoPassword","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE5E,MAAM,OAAO,QAAa,MAA0B,SAAyD;AACtG,UAAA,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AACX,eAAA,IAAIC,SAAAA,cAAc,KAAK,QAAQ;AAAA,MAAA;AAEvC,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AACpC,gBAAA,IAAIC,4BAAe,8DAA8D;AAAA,QAAA;AAEjF,eAAA,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAAA;AAEnC,aAAAC,SAAA;AAAA,IAAA,GACL;AAEH,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,QAAQ;AAAA,IAAA;AAEpC,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAElE,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQC,sBAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IAElE;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.js

@@ -1,69 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import { PasswordPlain, PasswordHash, NoPassword } from "../../../model/dtos/Password.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createErrorResponse } from "../../errorUtils.js";
-import { UserInputError } from "@contember/graphql-utils";
-import { PersonResponseFactory } from "../../responseHelpers/PersonResponseFactory.js";
-class SignUpMutationResolver {
-  constructor(signUpManager, apiKeyManager) {
-    this.signUpManager = signUpManager;
-    this.apiKeyManager = apiKeyManager;
-  }
-  async signUp(parent, args, context) {
-    const roles = args.roles ?? [];
-    await context.requireAccess({
-      action: PermissionActions.PERSON_SIGN_UP(roles),
-      message: "You are not allowed to sign up"
-    });
-    const password = (() => {
-      if (args.password) {
-        return new PasswordPlain(args.password);
-      }
-      if (args.passwordHash) {
-        if (!args.passwordHash.startsWith("$2b$")) {
-          throw new UserInputError("Invalid password hash. Only $2b$ bcrypt hashes are accepted.");
-        }
-        return new PasswordHash(args.passwordHash);
-      }
-      return NoPassword;
-    })();
-    const response = await this.signUpManager.signUp(context.db, {
-      email: args.email,
-      name: args.name ?? void 0,
-      password,
-      roles
-    });
-    if (!response.ok) {
-      return createErrorResponse(response);
-    }
-    const result = response.result;
-    await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId);
-    return {
-      ok: true,
-      errors: [],
-      result: {
-        person: PersonResponseFactory.createPersonResponse(result.person)
-      }
-    };
-  }
-}
-export {
-  SignUpMutationResolver
-};
-//# sourceMappingURL=SignUpMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport {\n\tApiKeyManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tSignUpManager,\n} from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE5E,MAAM,OAAO,QAAa,MAA0B,SAAyD;AACtG,UAAA,QAAQ,KAAK,SAAS,CAAC;AAC7B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AACX,eAAA,IAAI,cAAc,KAAK,QAAQ;AAAA,MAAA;AAEvC,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AACpC,gBAAA,IAAI,eAAe,8DAA8D;AAAA,QAAA;AAEjF,eAAA,IAAI,aAAa,KAAK,YAAY;AAAA,MAAA;AAEnC,aAAA;AAAA,IAAA,GACL;AAEH,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAEG,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IAAA;AAEpC,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAElE,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IAElE;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs

@@ -1,53 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-class TogglePasswordlessMutationResolver {
-  constructor(configurationManager, personManager) {
-    this.configurationManager = configurationManager;
-    this.personManager = personManager;
-  }
-  async enableMyPasswordless(parent, args, context) {
-    return this.doTogglePasswordless(context, true);
-  }
-  async disableMyPasswordless(parent, args, context) {
-    return this.doTogglePasswordless(context, false);
-  }
-  async doTogglePasswordless(context, value) {
-    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      return errorUtils.createErrorResponse("NOT_A_PERSON", "Only a person can change a password");
-    }
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
-      message: "You are not allowed to enable passwordless"
-    });
-    const config = await await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
-    if (config.passwordless?.enabled === "always" || config.passwordless?.enabled === "never") {
-      return errorUtils.createErrorResponse("CANNOT_TOGGLE", "Passwordless is configured globally and cannot be toggled");
-    }
-    await this.personManager.togglePasswordless(context.db, person, value);
-    return { ok: true };
-  }
-}
-exports.TogglePasswordlessMutationResolver = TogglePasswordlessMutationResolver;
-//# sourceMappingURL=TogglePasswordlessMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AAC1H,WAAA,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAAA;AAAA,EAG/C,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAC3H,WAAA,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAAA;AAAA,EAGhD,MAAc,qBACb,SACA,OACwC;AAClC,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IAAA;AAEjF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACjF,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AACnF,aAAAF,WAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IAAA;AAGxG,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAE9D,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAGpB;;"}

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js

@@ -1,53 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createErrorResponse } from "../../errorUtils.js";
-class TogglePasswordlessMutationResolver {
-  constructor(configurationManager, personManager) {
-    this.configurationManager = configurationManager;
-    this.personManager = personManager;
-  }
-  async enableMyPasswordless(parent, args, context) {
-    return this.doTogglePasswordless(context, true);
-  }
-  async disableMyPasswordless(parent, args, context) {
-    return this.doTogglePasswordless(context, false);
-  }
-  async doTogglePasswordless(context, value) {
-    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      return createErrorResponse("NOT_A_PERSON", "Only a person can change a password");
-    }
-    await context.requireAccess({
-      action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
-      message: "You are not allowed to enable passwordless"
-    });
-    const config = await await context.db.queryHandler.fetch(new ConfigurationQuery());
-    if (config.passwordless?.enabled === "always" || config.passwordless?.enabled === "never") {
-      return createErrorResponse("CANNOT_TOGGLE", "Passwordless is configured globally and cannot be toggled");
-    }
-    await this.personManager.togglePasswordless(context.db, person, value);
-    return { ok: true };
-  }
-}
-export {
-  TogglePasswordlessMutationResolver
-};
-//# sourceMappingURL=TogglePasswordlessMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AAC1H,WAAA,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAAA;AAAA,EAG/C,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAC3H,WAAA,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAAA;AAAA,EAGhD,MAAc,qBACb,SACA,OACwC;AAClC,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IAAA;AAEjF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AACjF,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AACnF,aAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IAAA;AAGxG,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAE9D,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAGpB;"}

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs

@@ -1,70 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-const Roles = require("../../../model/authorization/Roles.cjs");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-const token = require("../../../model/utils/token.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-const graphqlUtils = require("@contember/graphql-utils");
-class CreateProjectMutationResolver {
-  constructor(projectManager) {
-    this.projectManager = projectManager;
-  }
-  async createProject(parent, { projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
-    if (project) {
-      return errorUtils.createErrorResponse("ALREADY_EXISTS", `Project ${projectSlug} already exists`);
-    }
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.PROJECT_CREATE,
-      message: "You are not allowed to create a project"
-    });
-    const deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? void 0;
-    if (typeof deployTokenHash === "string" && !token.isTokenHash(deployTokenHash)) {
-      throw new graphqlUtils.UserInputError("Invalid format of deployTokenHash. Must be hex-encoded sha256.");
-    }
-    const isSuperAdmin = await context.identity.roles.includes(Roles.TenantRole.SUPER_ADMIN);
-    const response = await this.projectManager.createProject(
-      context.db,
-      context.logger,
-      {
-        slug: projectSlug,
-        name: name || projectSlug,
-        config: config || {},
-        secrets: Object.fromEntries((secrets || []).map((it) => [it.key, it.value]))
-      },
-      {
-        ownerIdentityId: isSuperAdmin ? void 0 : context.identity.id,
-        deployTokenHash,
-        noDeployToken: options?.noDeployToken ?? false
-      }
-    );
-    if (!response.ok) {
-      return errorUtils.createErrorResponse(response.error, response.errorMessage);
-    }
-    return {
-      ok: true,
-      error: null,
-      result: {
-        deployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken()
-      }
-    };
-  }
-}
-exports.CreateProjectMutationResolver = CreateProjectMutationResolver;
-//# sourceMappingURL=CreateProjectMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAQ,GAC1F,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IAAA;AAGrF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAA,YAAY,eAAe,GAAG;AACnE,YAAA,IAAIC,4BAAe,gEAAgE;AAAA,IAAA;AAG1F,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,iBAAW,WAAW;AAE3E,UAAA,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAC;AAAA,QAC5B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAM,OAAA,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAC1E;AAAA,MACA;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAE3C;AACI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAoB,oBAAA,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAE1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAkB;AAAA,MAAA;AAAA,IAEpE;AAAA,EAAA;AAEF;;"}

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.js

@@ -1,70 +0,0 @@
-import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
-import "@contember/authorization";
-import { TenantRole } from "../../../model/authorization/Roles.js";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import { isTokenHash } from "../../../model/utils/token.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import "node:assert";
-import "../../../model/service/idp/providers/AppleProvider.js";
-import "openid-client";
-import "@contember/typesafe";
-import "../../../model/service/idp/providers/OIDCTypes.js";
-import "../../../model/service/idp/providers/FacebookProvider.js";
-import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
-import "otpauth";
-import { createErrorResponse } from "../../errorUtils.js";
-import { UserInputError } from "@contember/graphql-utils";
-class CreateProjectMutationResolver {
-  constructor(projectManager) {
-    this.projectManager = projectManager;
-  }
-  async createProject(parent, { projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
-    if (project) {
-      return createErrorResponse("ALREADY_EXISTS", `Project ${projectSlug} already exists`);
-    }
-    await context.requireAccess({
-      action: PermissionActions.PROJECT_CREATE,
-      message: "You are not allowed to create a project"
-    });
-    const deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? void 0;
-    if (typeof deployTokenHash === "string" && !isTokenHash(deployTokenHash)) {
-      throw new UserInputError("Invalid format of deployTokenHash. Must be hex-encoded sha256.");
-    }
-    const isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN);
-    const response = await this.projectManager.createProject(
-      context.db,
-      context.logger,
-      {
-        slug: projectSlug,
-        name: name || projectSlug,
-        config: config || {},
-        secrets: Object.fromEntries((secrets || []).map((it) => [it.key, it.value]))
-      },
-      {
-        ownerIdentityId: isSuperAdmin ? void 0 : context.identity.id,
-        deployTokenHash,
-        noDeployToken: options?.noDeployToken ?? false
-      }
-    );
-    if (!response.ok) {
-      return createErrorResponse(response.error, response.errorMessage);
-    }
-    return {
-      ok: true,
-      error: null,
-      result: {
-        deployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken()
-      }
-    };
-  }
-}
-export {
-  CreateProjectMutationResolver
-};
-//# sourceMappingURL=CreateProjectMutationResolver.js.map

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAQ,GAC1F,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IAAA;AAGrF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACnE,YAAA,IAAI,eAAe,gEAAgE;AAAA,IAAA;AAG1F,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAE3E,UAAA,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAC;AAAA,QAC5B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAM,OAAA,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAC1E;AAAA,MACA;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAE3C;AACI,QAAA,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IAAA;AAE1D,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAkB;AAAA,MAAA;AAAA,IAEpE;AAAA,EAAA;AAEF;"}

package/dist/development/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs

@@ -1,42 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-require("node:assert");
-require("../../../model/service/idp/providers/AppleProvider.cjs");
-require("openid-client");
-require("@contember/typesafe");
-require("../../../model/service/idp/providers/OIDCTypes.cjs");
-require("../../../model/service/idp/providers/FacebookProvider.cjs");
-require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
-require("otpauth");
-const errorUtils = require("../../errorUtils.cjs");
-class SetProjectSecretMutationResolver {
-  constructor(projectManager, secretManager) {
-    this.projectManager = projectManager;
-    this.secretManager = secretManager;
-  }
-  async setProjectSecret(parent, args, context) {
-    const project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug);
-    await context.requireAccess({
-      scope: await context.permissionContext.createProjectScope(project),
-      action: PermissionActions.PermissionActions.PROJECT_SET_SECRET,
-      message: "You are not allowed to set project secrets"
-    });
-    if (!project) {
-      return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", args.projectSlug);
-    }
-    await this.secretManager.setSecret(context.db, project.id, args.key, args.value);
-    return { ok: true };
-  }
-}
-exports.SetProjectSecretMutationResolver = SetProjectSecretMutationResolver;
-//# sourceMappingURL=SetProjectSecretMutationResolver.cjs.map