@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MailTemplateMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { validateEmail } from '../../../model/utils/email'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() || null,\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["type","PermissionActions","createProjectNotFoundResponse","validateEmail","createErrorResponse","mailTypeFromSchemaToDb"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAA,MAASA,QAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAACC,oBAAc,OAAO,GAAG;AACvC,aAAOC,WAAAA,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAMC,KAAAA,uBAAuBL,MAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAA,MAAaA,QAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAMG,KAAAA,uBAAuBL,MAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAOI,WAAAA,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js

@@ -0,0 +1,81 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { validateEmail } from "../../../model/utils/email.js";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { mailTypeFromSchemaToDb } from "../../../model/mailing/type.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
+class MailTemplateMutationResolver {
+  constructor(projectManager, mailTemplateManager) {
+    this.projectManager = projectManager;
+    this.mailTemplateManager = mailTemplateManager;
+  }
+  async addMailTemplate(parent, { template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }, context) {
+    const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
+    await context.requireAccess({
+      scope: project ? await context.permissionContext.createProjectScope(project) : void 0,
+      action: PermissionActions.MAIL_TEMPLATE_ADD,
+      message: "You are not allowed to add a mail template"
+    });
+    if (projectSlug && !project) {
+      return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
+    }
+    if (replyTo && !validateEmail(replyTo)) {
+      return createErrorResponse("INVALID_REPLY_EMAIL_FORMAT", "Reply-to email address is not in a valid format");
+    }
+    await this.mailTemplateManager.addMailTemplate(context.db, {
+      content,
+      projectId: project?.id ?? null,
+      subject,
+      useLayout: typeof useLayout === "boolean" ? useLayout : true,
+      variant: variant || "",
+      type: mailTypeFromSchemaToDb(type),
+      replyTo: replyTo?.trim() || null
+    });
+    return {
+      ok: true,
+      errors: []
+    };
+  }
+  async removeMailTemplate(parent, { templateIdentifier: { projectSlug, type, variant } }, context) {
+    const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
+    await context.requireAccess({
+      scope: project ? await context.permissionContext.createProjectScope(project) : void 0,
+      action: PermissionActions.MAIL_TEMPLATE_REMOVE,
+      message: "You are not allowed to remove a mail template"
+    });
+    if (projectSlug && !project) {
+      return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
+    }
+    const removed = await this.mailTemplateManager.removeMailTemplate(context.db, {
+      projectId: project?.id ?? null,
+      variant: variant || "",
+      type: mailTypeFromSchemaToDb(type)
+    });
+    if (!removed) {
+      return createErrorResponse("PROJECT_NOT_FOUND", "Mail template not found");
+    }
+    return {
+      ok: true,
+      errors: []
+    };
+  }
+}
+export {
+  MailTemplateMutationResolver
+};
+//# sourceMappingURL=MailTemplateMutationResolver.js.map

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MailTemplateMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { validateEmail } from '../../../model/utils/email'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() || null,\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAS,MAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAAC,cAAc,OAAO,GAAG;AACvC,aAAO,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAa,MAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAO,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.cjs

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+const IdentityScope = require("../../../model/authorization/IdentityScope.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/authorization");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class ChangePasswordMutationResolver {
+  constructor(passwordChangeManager) {
+    this.passwordChangeManager = passwordChangeManager;
+  }
+  async changePassword(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byId(args.personId));
+    if (!person) {
+      return errorUtils.createErrorResponse("PERSON_NOT_FOUND", "Person not found");
+    }
+    await context.requireAccess({
+      scope: new IdentityScope.IdentityScope(person.identity_id),
+      action: PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
+      message: "You are not allowed to change password"
+    });
+    const response = await this.passwordChangeManager.changePassword(context.db, person, args.password);
+    await context.logAuthAction({
+      type: "password_change",
+      response,
+      personId: person.id
+    });
+    if (!response.ok) {
+      return errorUtils.createErrorResponse(response);
+    }
+    return { ok: true, errors: [] };
+  }
+  async changeMyPassword(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      return errorUtils.createErrorResponse("NOT_A_PERSON", "Only a person can change a password");
+    }
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_CHANGE_MY_PASSWORD,
+      message: "You are not allowed to change password"
+    });
+    const response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword);
+    await context.logAuthAction({
+      type: "password_change",
+      response,
+      personId: person.id
+    });
+    if (!response.ok) {
+      return errorUtils.createErrorResponse(response);
+    }
+    return { ok: true };
+  }
+}
+exports.ChangePasswordMutationResolver = ChangePasswordMutationResolver;
+//# sourceMappingURL=ChangePasswordMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangePasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.js

@@ -0,0 +1,71 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import { IdentityScope } from "../../../model/authorization/IdentityScope.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/authorization";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class ChangePasswordMutationResolver {
+  constructor(passwordChangeManager) {
+    this.passwordChangeManager = passwordChangeManager;
+  }
+  async changePassword(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId));
+    if (!person) {
+      return createErrorResponse("PERSON_NOT_FOUND", "Person not found");
+    }
+    await context.requireAccess({
+      scope: new IdentityScope(person.identity_id),
+      action: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
+      message: "You are not allowed to change password"
+    });
+    const response = await this.passwordChangeManager.changePassword(context.db, person, args.password);
+    await context.logAuthAction({
+      type: "password_change",
+      response,
+      personId: person.id
+    });
+    if (!response.ok) {
+      return createErrorResponse(response);
+    }
+    return { ok: true, errors: [] };
+  }
+  async changeMyPassword(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      return createErrorResponse("NOT_A_PERSON", "Only a person can change a password");
+    }
+    await context.requireAccess({
+      action: PermissionActions.PERSON_CHANGE_MY_PASSWORD,
+      message: "You are not allowed to change password"
+    });
+    const response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword);
+    await context.logAuthAction({
+      type: "password_change",
+      response,
+      personId: person.id
+    });
+    if (!response.ok) {
+      return createErrorResponse(response);
+    }
+    return { ok: true };
+  }
+}
+export {
+  ChangePasswordMutationResolver
+};
+//# sourceMappingURL=ChangePasswordMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangePasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.cjs

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+const IdentityScope = require("../../../model/authorization/IdentityScope.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/authorization");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class ChangeProfileMutationResolver {
+  constructor(personManager) {
+    this.personManager = personManager;
+  }
+  async changeProfile(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byId(args.personId));
+    if (!person) {
+      return errorUtils.createErrorResponse("PERSON_NOT_FOUND", "Person not found");
+    }
+    if (args.email === null) {
+      return errorUtils.createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
+    }
+    await context.requireAccess({
+      scope: new IdentityScope.IdentityScope(person.identity_id),
+      action: PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(person.roles),
+      message: "You are not allowed to change a profile"
+    });
+    const result = await this.personManager.changeProfile(context.db, person, {
+      email: args.email,
+      name: args.name === "" ? null : args.name
+    });
+    if (args.email) {
+      await context.logAuthAction({
+        type: "email_change",
+        response: result
+      });
+    }
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async changeMyProfile(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      return errorUtils.createErrorResponse("NOT_A_PERSON", "Only a person can change a profile.");
+    }
+    if (args.email === null) {
+      return errorUtils.createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
+    }
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_CHANGE_MY_PROFILE,
+      message: "You are not allowed to change profile"
+    });
+    const result = await this.personManager.changeProfile(context.db, person, {
+      email: args.email,
+      name: args.name === "" ? null : args.name
+    });
+    if (args.email) {
+      await context.logAuthAction({
+        type: "email_change",
+        response: result,
+        personId: person.id
+      });
+    }
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+exports.ChangeProfileMutationResolver = ChangeProfileMutationResolver;
+//# sourceMappingURL=ChangeProfileMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangeProfileMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IdentityScope, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAAsG;AAAA,EAClH,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.js

@@ -0,0 +1,86 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import { IdentityScope } from "../../../model/authorization/IdentityScope.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/authorization";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class ChangeProfileMutationResolver {
+  constructor(personManager) {
+    this.personManager = personManager;
+  }
+  async changeProfile(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId));
+    if (!person) {
+      return createErrorResponse("PERSON_NOT_FOUND", "Person not found");
+    }
+    if (args.email === null) {
+      return createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
+    }
+    await context.requireAccess({
+      scope: new IdentityScope(person.identity_id),
+      action: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),
+      message: "You are not allowed to change a profile"
+    });
+    const result = await this.personManager.changeProfile(context.db, person, {
+      email: args.email,
+      name: args.name === "" ? null : args.name
+    });
+    if (args.email) {
+      await context.logAuthAction({
+        type: "email_change",
+        response: result
+      });
+    }
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async changeMyProfile(parent, args, context, info) {
+    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      return createErrorResponse("NOT_A_PERSON", "Only a person can change a profile.");
+    }
+    if (args.email === null) {
+      return createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
+    }
+    await context.requireAccess({
+      action: PermissionActions.PERSON_CHANGE_MY_PROFILE,
+      message: "You are not allowed to change profile"
+    });
+    const result = await this.personManager.changeProfile(context.db, person, {
+      email: args.email,
+      name: args.name === "" ? null : args.name
+    });
+    if (args.email) {
+      await context.logAuthAction({
+        type: "email_change",
+        response: result,
+        personId: person.id
+      });
+    }
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+export {
+  ChangeProfileMutationResolver
+};
+//# sourceMappingURL=ChangeProfileMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangeProfileMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationResolvers,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { IdentityScope, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAAsG;AAAA,EAClH,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class DisablePersonMutationResolver {
+  constructor(personAccessManager, personManager) {
+    this.personAccessManager = personAccessManager;
+    this.personManager = personManager;
+  }
+  async disablePerson(parent, args, context) {
+    const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
+    if (targetPerson === null) {
+      return {
+        ok: false,
+        error: {
+          code: "PERSON_NOT_FOUND",
+          developerMessage: `Person <${args.personId}> was not found`
+        }
+      };
+    }
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_DISABLE(targetPerson.roles),
+      message: "You are not allowed to disable person account"
+    });
+    const result = await this.personAccessManager.disablePerson(context.db, targetPerson);
+    await context.logAuthAction({
+      type: "person_disable",
+      response: result,
+      personId: targetPerson.id
+    });
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return {
+      ok: true
+    };
+  }
+}
+exports.DisablePersonMutationResolver = DisablePersonMutationResolver;
+//# sourceMappingURL=DisablePersonMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\tpersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,YAAY;AACpF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IAAA,CACvB;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.js

@@ -0,0 +1,57 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class DisablePersonMutationResolver {
+  constructor(personAccessManager, personManager) {
+    this.personAccessManager = personAccessManager;
+    this.personManager = personManager;
+  }
+  async disablePerson(parent, args, context) {
+    const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
+    if (targetPerson === null) {
+      return {
+        ok: false,
+        error: {
+          code: "PERSON_NOT_FOUND",
+          developerMessage: `Person <${args.personId}> was not found`
+        }
+      };
+    }
+    await context.requireAccess({
+      action: PermissionActions.PERSON_DISABLE(targetPerson.roles),
+      message: "You are not allowed to disable person account"
+    });
+    const result = await this.personAccessManager.disablePerson(context.db, targetPerson);
+    await context.logAuthAction({
+      type: "person_disable",
+      response: result,
+      personId: targetPerson.id
+    });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return {
+      ok: true
+    };
+  }
+}
+export {
+  DisablePersonMutationResolver
+};
+//# sourceMappingURL=DisablePersonMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, PersonAccessManager } from '../../../model'\nimport { PersonManager } from '../../../model/service/PersonManager'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\tpersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,YAAY;AACpF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IAAA,CACvB;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}