@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/development/src/model/service/idp/IDPManager.cjs

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../../utils/Response.cjs");
+require("../../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const IdentityProviderBySlugQuery = require("../../queries/idp/IdentityProviderBySlugQuery.cjs");
+const IdentityProvidersQuery = require("../../queries/idp/IdentityProvidersQuery.cjs");
+require("../../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../authorization/PermissionContext.cjs");
+require("../../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const CreateIdpCommand = require("../../commands/idp/CreateIdpCommand.cjs");
+const IdentityProviderNotFoundError = require("./IdentityProviderNotFoundError.cjs");
+const InvalidIDPConfigurationError = require("./InvalidIDPConfigurationError.cjs");
+const DisableIdpCommand = require("../../commands/idp/DisableIdpCommand.cjs");
+const EnableIdpCommand = require("../../commands/idp/EnableIdpCommand.cjs");
+const UpdateIdpCommand = require("../../commands/idp/UpdateIdpCommand.cjs");
+class IDPManager {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async addIDP(db, idp) {
+    return await db.transaction(async (db2) => {
+      try {
+        const providerService = this.idpRegistry.getHandler(idp.type);
+        providerService.validateConfiguration(idp.configuration);
+      } catch (e) {
+        if (e instanceof IdentityProviderNotFoundError.IdentityProviderNotFoundError) {
+          return new Response.ResponseError("UNKNOWN_TYPE", `IDP type ${idp.type} not found`);
+        }
+        if (e instanceof InvalidIDPConfigurationError.InvalidIDPConfigurationError) {
+          return new Response.ResponseError("INVALID_CONFIGURATION", `Invalid IDP configuration: ${e.message}`);
+        }
+        throw e;
+      }
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(idp.slug));
+      if (existing) {
+        return new Response.ResponseError("ALREADY_EXISTS", `IDP with slug ${idp.slug} already exists`);
+      }
+      await db2.commandBus.execute(new CreateIdpCommand.CreateIdpCommand(idp));
+      return new Response.ResponseOk(null);
+    });
+  }
+  async disableIDP(db, slug) {
+    return await db.transaction(async (db2) => {
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(slug));
+      if (!existing) {
+        return new Response.ResponseError("NOT_FOUND", `IDP ${slug} not found`);
+      }
+      if (!existing.disabledAt) {
+        await db2.commandBus.execute(new DisableIdpCommand.DisableIdpCommand(existing.id));
+      }
+      return new Response.ResponseOk(null);
+    });
+  }
+  async enableIDP(db, slug) {
+    return await db.transaction(async (db2) => {
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(slug));
+      if (!existing) {
+        return new Response.ResponseError("NOT_FOUND", `IDP ${slug} not found`);
+      }
+      if (existing.disabledAt) {
+        await db2.commandBus.execute(new EnableIdpCommand.EnableIdpCommand(existing.id));
+      }
+      return new Response.ResponseOk(null);
+    });
+  }
+  async updateIDP(db, slug, data, mergeConfiguration) {
+    return await db.transaction(async (db2) => {
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(slug));
+      if (!existing) {
+        return new Response.ResponseError("NOT_FOUND", `IDP ${slug} not found`);
+      }
+      const newConfiguration = (() => {
+        if (!data.configuration) {
+          return existing.configuration;
+        }
+        if (!mergeConfiguration) {
+          return data.configuration;
+        }
+        const newConfiguration2 = { ...existing.configuration };
+        for (const [key, value] of Object.entries(data.configuration)) {
+          if (value === null) {
+            delete newConfiguration2[key];
+          } else {
+            newConfiguration2[key] = value;
+          }
+        }
+        return newConfiguration2;
+      })();
+      try {
+        const type = data.type ?? existing.type;
+        const providerService = this.idpRegistry.getHandler(type);
+        if (data.configuration !== void 0 || type !== existing.type) {
+          providerService.validateConfiguration(newConfiguration);
+        }
+      } catch (e) {
+        if (e instanceof InvalidIDPConfigurationError.InvalidIDPConfigurationError) {
+          return new Response.ResponseError("INVALID_CONFIGURATION", `Invalid IDP configuration: ${e.message}`);
+        }
+        throw e;
+      }
+      await db2.commandBus.execute(
+        new UpdateIdpCommand.UpdateIdpCommand(existing.id, {
+          ...data,
+          configuration: data.configuration ? newConfiguration : void 0
+        })
+      );
+      return new Response.ResponseOk(null);
+    });
+  }
+  async listIDP(db) {
+    const result = await db.queryHandler.fetch(new IdentityProvidersQuery.IdentityProvidersQuery());
+    return result.map((it) => {
+      const providerService = this.idpRegistry.getHandlerOrNull(it.type);
+      const configuration = providerService?.getPublicConfiguration ? providerService.getPublicConfiguration(it.configuration) : it.configuration;
+      return { ...it, configuration };
+    });
+  }
+}
+exports.IDPManager = IDPManager;
+//# sourceMappingURL=IDPManager.cjs.map

package/dist/development/src/model/service/idp/IDPManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema'\nimport { DatabaseContext } from '../../utils'\nimport { IdentityProviderData } from '../../type'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand'\nimport { IdentityProviderDto } from '../../queries/idp/types'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","IdentityProviderNotFoundError","ResponseError","InvalidIDPConfigurationError","IdentityProviderBySlugQuery","CreateIdpCommand","ResponseOk","DisableIdpCommand","EnableIdpCommand","newConfiguration","UpdateIdpCommand","IdentityProvidersQuery"],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAaC,8BAAAA,+BAA+B;AAC/C,iBAAO,IAAIC,SAAAA,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAaC,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMF,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAIF,SAAAA,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMF,IAAG,WAAW,QAAQ,IAAIK,iBAAAA,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMF,IAAG,WAAW,QAAQ,IAAIO,kBAAAA,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMF,IAAG,WAAW,QAAQ,IAAIQ,iBAAAA,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAIF,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMO,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAaN,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMF,IAAG,WAAW;AAAA,QACnB,IAAIU,iBAAAA,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAIJ,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAIK,uBAAAA,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/idp/IDPManager.js

@@ -0,0 +1,123 @@
+import { ResponseError, ResponseOk } from "../../utils/Response.js";
+import "../../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { IdentityProviderBySlugQuery } from "../../queries/idp/IdentityProviderBySlugQuery.js";
+import { IdentityProvidersQuery } from "../../queries/idp/IdentityProvidersQuery.js";
+import "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { CreateIdpCommand } from "../../commands/idp/CreateIdpCommand.js";
+import { IdentityProviderNotFoundError } from "./IdentityProviderNotFoundError.js";
+import { InvalidIDPConfigurationError } from "./InvalidIDPConfigurationError.js";
+import { DisableIdpCommand } from "../../commands/idp/DisableIdpCommand.js";
+import { EnableIdpCommand } from "../../commands/idp/EnableIdpCommand.js";
+import { UpdateIdpCommand } from "../../commands/idp/UpdateIdpCommand.js";
+class IDPManager {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async addIDP(db, idp) {
+    return await db.transaction(async (db2) => {
+      try {
+        const providerService = this.idpRegistry.getHandler(idp.type);
+        providerService.validateConfiguration(idp.configuration);
+      } catch (e) {
+        if (e instanceof IdentityProviderNotFoundError) {
+          return new ResponseError("UNKNOWN_TYPE", `IDP type ${idp.type} not found`);
+        }
+        if (e instanceof InvalidIDPConfigurationError) {
+          return new ResponseError("INVALID_CONFIGURATION", `Invalid IDP configuration: ${e.message}`);
+        }
+        throw e;
+      }
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug));
+      if (existing) {
+        return new ResponseError("ALREADY_EXISTS", `IDP with slug ${idp.slug} already exists`);
+      }
+      await db2.commandBus.execute(new CreateIdpCommand(idp));
+      return new ResponseOk(null);
+    });
+  }
+  async disableIDP(db, slug) {
+    return await db.transaction(async (db2) => {
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery(slug));
+      if (!existing) {
+        return new ResponseError("NOT_FOUND", `IDP ${slug} not found`);
+      }
+      if (!existing.disabledAt) {
+        await db2.commandBus.execute(new DisableIdpCommand(existing.id));
+      }
+      return new ResponseOk(null);
+    });
+  }
+  async enableIDP(db, slug) {
+    return await db.transaction(async (db2) => {
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery(slug));
+      if (!existing) {
+        return new ResponseError("NOT_FOUND", `IDP ${slug} not found`);
+      }
+      if (existing.disabledAt) {
+        await db2.commandBus.execute(new EnableIdpCommand(existing.id));
+      }
+      return new ResponseOk(null);
+    });
+  }
+  async updateIDP(db, slug, data, mergeConfiguration) {
+    return await db.transaction(async (db2) => {
+      const existing = await db2.queryHandler.fetch(new IdentityProviderBySlugQuery(slug));
+      if (!existing) {
+        return new ResponseError("NOT_FOUND", `IDP ${slug} not found`);
+      }
+      const newConfiguration = (() => {
+        if (!data.configuration) {
+          return existing.configuration;
+        }
+        if (!mergeConfiguration) {
+          return data.configuration;
+        }
+        const newConfiguration2 = { ...existing.configuration };
+        for (const [key, value] of Object.entries(data.configuration)) {
+          if (value === null) {
+            delete newConfiguration2[key];
+          } else {
+            newConfiguration2[key] = value;
+          }
+        }
+        return newConfiguration2;
+      })();
+      try {
+        const type = data.type ?? existing.type;
+        const providerService = this.idpRegistry.getHandler(type);
+        if (data.configuration !== void 0 || type !== existing.type) {
+          providerService.validateConfiguration(newConfiguration);
+        }
+      } catch (e) {
+        if (e instanceof InvalidIDPConfigurationError) {
+          return new ResponseError("INVALID_CONFIGURATION", `Invalid IDP configuration: ${e.message}`);
+        }
+        throw e;
+      }
+      await db2.commandBus.execute(
+        new UpdateIdpCommand(existing.id, {
+          ...data,
+          configuration: data.configuration ? newConfiguration : void 0
+        })
+      );
+      return new ResponseOk(null);
+    });
+  }
+  async listIDP(db) {
+    const result = await db.queryHandler.fetch(new IdentityProvidersQuery());
+    return result.map((it) => {
+      const providerService = this.idpRegistry.getHandlerOrNull(it.type);
+      const configuration = providerService?.getPublicConfiguration ? providerService.getPublicConfiguration(it.configuration) : it.configuration;
+      return { ...it, configuration };
+    });
+  }
+}
+export {
+  IDPManager
+};
+//# sourceMappingURL=IDPManager.js.map

package/dist/development/src/model/service/idp/IDPManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema'\nimport { DatabaseContext } from '../../utils'\nimport { IdentityProviderData } from '../../type'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand'\nimport { IdentityProviderDto } from '../../queries/idp/types'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","newConfiguration"],"mappings":";;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAa,+BAA+B;AAC/C,iBAAO,IAAI,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAa,8BAA8B;AAC9C,iBAAO,IAAI,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAI,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMA,IAAG,WAAW,QAAQ,IAAI,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMA,IAAG,WAAW,QAAQ,IAAI,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMA,IAAG,WAAW,QAAQ,IAAI,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMC,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAa,8BAA8B;AAC9C,iBAAO,IAAI,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMD,IAAG,WAAW;AAAA,QACnB,IAAI,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAI,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/idp/IDPResponseError.cjs

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class IDPResponseError extends Error {
+}
+exports.IDPResponseError = IDPResponseError;
+//# sourceMappingURL=IDPResponseError.cjs.map

package/dist/development/src/model/service/idp/IDPResponseError.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPResponseError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPResponseError.ts"],"sourcesContent":["export class IDPResponseError extends Error {\n}\n"],"names":[],"mappings":";;AAAO,MAAM,yBAAyB,MAAM;AAC5C;;"}

package/dist/development/src/model/service/idp/IDPResponseError.js

@@ -0,0 +1,6 @@
+class IDPResponseError extends Error {
+}
+export {
+  IDPResponseError
+};
+//# sourceMappingURL=IDPResponseError.js.map

package/dist/development/src/model/service/idp/IDPResponseError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPResponseError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPResponseError.ts"],"sourcesContent":["export class IDPResponseError extends Error {\n}\n"],"names":[],"mappings":"AAAO,MAAM,yBAAyB,MAAM;AAC5C;"}

package/dist/development/src/model/service/idp/IDPValidationError.cjs

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class IDPValidationError extends Error {
+}
+exports.IDPValidationError = IDPValidationError;
+//# sourceMappingURL=IDPValidationError.cjs.map

package/dist/development/src/model/service/idp/IDPValidationError.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPValidationError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPValidationError.ts"],"sourcesContent":["export class IDPValidationError extends Error {\n}\n"],"names":[],"mappings":";;AAAO,MAAM,2BAA2B,MAAM;AAC9C;;"}

package/dist/development/src/model/service/idp/IDPValidationError.js

@@ -0,0 +1,6 @@
+class IDPValidationError extends Error {
+}
+export {
+  IDPValidationError
+};
+//# sourceMappingURL=IDPValidationError.js.map

package/dist/development/src/model/service/idp/IDPValidationError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPValidationError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPValidationError.ts"],"sourcesContent":["export class IDPValidationError extends Error {\n}\n"],"names":[],"mappings":"AAAO,MAAM,2BAA2B,MAAM;AAC9C;"}

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.cjs

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class IdentityProviderNotFoundError extends Error {
+}
+exports.IdentityProviderNotFoundError = IdentityProviderNotFoundError;
+//# sourceMappingURL=IdentityProviderNotFoundError.cjs.map

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityProviderNotFoundError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdentityProviderNotFoundError.ts"],"sourcesContent":["export class IdentityProviderNotFoundError extends Error {\n}\n"],"names":[],"mappings":";;AAAO,MAAM,sCAAsC,MAAM;AACzD;;"}

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.js

@@ -0,0 +1,6 @@
+class IdentityProviderNotFoundError extends Error {
+}
+export {
+  IdentityProviderNotFoundError
+};
+//# sourceMappingURL=IdentityProviderNotFoundError.js.map

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityProviderNotFoundError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdentityProviderNotFoundError.ts"],"sourcesContent":["export class IdentityProviderNotFoundError extends Error {\n}\n"],"names":[],"mappings":"AAAO,MAAM,sCAAsC,MAAM;AACzD;"}

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.cjs

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class InvalidIDPConfigurationError extends Error {
+}
+exports.InvalidIDPConfigurationError = InvalidIDPConfigurationError;
+//# sourceMappingURL=InvalidIDPConfigurationError.cjs.map

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvalidIDPConfigurationError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/InvalidIDPConfigurationError.ts"],"sourcesContent":["export class InvalidIDPConfigurationError extends Error {\n}\n"],"names":[],"mappings":";;AAAO,MAAM,qCAAqC,MAAM;AACxD;;"}

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.js

@@ -0,0 +1,6 @@
+class InvalidIDPConfigurationError extends Error {
+}
+export {
+  InvalidIDPConfigurationError
+};
+//# sourceMappingURL=InvalidIDPConfigurationError.js.map

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvalidIDPConfigurationError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/InvalidIDPConfigurationError.ts"],"sourcesContent":["export class InvalidIDPConfigurationError extends Error {\n}\n"],"names":[],"mappings":"AAAO,MAAM,qCAAqC,MAAM;AACxD;"}

package/dist/development/src/model/service/idp/providers/AppleProvider.cjs

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+const OIDCTypes = require("./OIDCTypes.cjs");
+const helpers = require("./helpers.cjs");
+const IDPValidationError = require("../IDPValidationError.cjs");
+const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
+const OIDCHelpers = require("./OIDCHelpers.cjs");
+const openidClient = require("openid-client");
+const jose = require("jose");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const AppleConfiguration = Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    keyId: Typesafe__namespace.string,
+    teamId: Typesafe__namespace.string,
+    clientId: Typesafe__namespace.string,
+    privateKey: Typesafe__namespace.string
+  }),
+  OIDCTypes.OIDCConfigurationOptions
+);
+const APPLE_OIDC_CONFIGURATION_ENDPOINT = "https://appleid.apple.com/.well-known/openid-configuration";
+class AppleProvider {
+  constructor() {
+    __publicField(this, "issuer");
+    __publicField(this, "validateConfiguration", helpers.catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.initOIDCAuth(client, {
+      scope: configuration.scope ?? configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = helpers.catchTypesafe(OIDCTypes.OIDCResponseData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.handleOIDCResponse(client, responseData);
+  }
+  getPublicConfiguration({ privateKey, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    this.issuer ?? (this.issuer = await openidClient.Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT));
+    const privateKey = await jose.importPKCS8(configuration.privateKey, "ES256");
+    const jwt = await new jose.SignJWT({}).setProtectedHeader({ alg: "ES256", typ: "JWT", kid: configuration.keyId }).setIssuedAt().setIssuer(configuration.teamId).setAudience("https://appleid.apple.com").setSubject(configuration.clientId).setExpirationTime("10m").sign(privateKey);
+    return new this.issuer.Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: jwt,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+exports.AppleConfiguration = AppleConfiguration;
+exports.AppleProvider = AppleProvider;
+//# sourceMappingURL=AppleProvider.cjs.map

package/dist/development/src/model/service/idp/providers/AppleProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppleProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["Typesafe","OIDCConfigurationOptions","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","importPKCS8","SignJWT"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,qBAAqBA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,IAChB,QAAQA,oBAAS;AAAA,IACjB,UAAUA,oBAAS;AAAA,IACnB,YAAYA,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDC,UAAAA;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,oBAAoBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAeJ,QAAAA,cAAcK,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAMC,oBAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAMC,KAAAA,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAIC,KAAAA,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;;"}

package/dist/development/src/model/service/idp/providers/AppleProvider.js

@@ -0,0 +1,64 @@
+import * as Typesafe from "@contember/typesafe";
+import { OIDCConfigurationOptions, OIDCInitData, OIDCResponseData } from "./OIDCTypes.js";
+import { catchTypesafe } from "./helpers.js";
+import { IDPValidationError } from "../IDPValidationError.js";
+import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
+import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
+import { Issuer } from "openid-client";
+import { importPKCS8, SignJWT } from "jose";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const AppleConfiguration = Typesafe.intersection(
+  Typesafe.object({
+    keyId: Typesafe.string,
+    teamId: Typesafe.string,
+    clientId: Typesafe.string,
+    privateKey: Typesafe.string
+  }),
+  OIDCConfigurationOptions
+);
+const APPLE_OIDC_CONFIGURATION_ENDPOINT = "https://appleid.apple.com/.well-known/openid-configuration";
+class AppleProvider {
+  constructor() {
+    __publicField(this, "issuer");
+    __publicField(this, "validateConfiguration", catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await initOIDCAuth(client, {
+      scope: configuration.scope ?? configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await handleOIDCResponse(client, responseData);
+  }
+  getPublicConfiguration({ privateKey, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    this.issuer ?? (this.issuer = await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT));
+    const privateKey = await importPKCS8(configuration.privateKey, "ES256");
+    const jwt = await new SignJWT({}).setProtectedHeader({ alg: "ES256", typ: "JWT", kid: configuration.keyId }).setIssuedAt().setIssuer(configuration.teamId).setAudience("https://appleid.apple.com").setSubject(configuration.clientId).setExpirationTime("10m").sign(privateKey);
+    return new this.issuer.Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: jwt,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+export {
+  AppleConfiguration,
+  AppleProvider
+};
+//# sourceMappingURL=AppleProvider.js.map

package/dist/development/src/model/service/idp/providers/AppleProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwB,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}