@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/production/src/resolvers/responseHelpers/PersonResponseFactory.js

@@ -0,0 +1,19 @@
+class PersonResponseFactory {
+  static createPersonResponse(personRow, projects = []) {
+    return {
+      id: personRow.id,
+      otpEnabled: !!personRow.otp_activated_at,
+      email: personRow.email,
+      name: personRow.name,
+      passwordlessEnabled: personRow.passwordless_enabled,
+      identity: {
+        id: personRow.identity_id,
+        projects
+      }
+    };
+  }
+}
+export {
+  PersonResponseFactory
+};
+//# sourceMappingURL=PersonResponseFactory.js.map

package/dist/production/src/resolvers/responseHelpers/PersonResponseFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonRow } from '../../model'\nimport { IdentityProjectRelation, Person } from '../../schema'\n\nexport class PersonResponseFactory {\n\tpublic static createPersonResponse(personRow: Omit<PersonRow, 'roles'>, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temail: personRow.email,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,WAAqC,WAAmD,IAAY;AACtI,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,OAAO,UAAU;AAAA,MACjB,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA,MAC/B,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AACD;"}

package/dist/production/src/resolvers/responseHelpers/SignInResponseFactory.cjs

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("node:assert");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+require("@contember/graphql-utils");
+const PersonResponseFactory = require("./PersonResponseFactory.cjs");
+require("@contember/config-loader");
+const TenantResolverContextFactory = require("../TenantResolverContextFactory.cjs");
+class SignInResponseFactory {
+  constructor(permissionContextFactory, identityTypeResolver) {
+    this.permissionContextFactory = permissionContextFactory;
+    this.identityTypeResolver = identityTypeResolver;
+  }
+  async createResponse(signInResult, context) {
+    const identityId = signInResult.person.identity_id;
+    const permissionContext = this.permissionContextFactory.create(context.db, {
+      id: identityId,
+      roles: signInResult.person.roles
+    });
+    const projects = await this.identityTypeResolver.projects(
+      { id: identityId, projects: [] },
+      {},
+      {
+        ...context,
+        ...TenantResolverContextFactory.createResolverContext(permissionContext, context.apiKeyId)
+      }
+    );
+    return {
+      token: signInResult.token,
+      person: PersonResponseFactory.PersonResponseFactory.createPersonResponse(signInResult.person, projects)
+    };
+  }
+}
+exports.SignInResponseFactory = SignInResponseFactory;
+//# sourceMappingURL=SignInResponseFactory.cjs.map

package/dist/production/src/resolvers/responseHelpers/SignInResponseFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/SignInResponseFactory.ts"],"sourcesContent":["import { createResolverContext, IdentityTypeResolver, TenantResolverContext } from '../index'\nimport { PermissionContextFactory, SignInResult } from '../../model'\nimport { CommonSignInResult } from '../../schema'\nimport { PersonResponseFactory } from './PersonResponseFactory'\n\nexport class SignInResponseFactory {\n\tconstructor(\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly identityTypeResolver: IdentityTypeResolver,\n\t) {\n\t}\n\n\tpublic async createResponse(signInResult: SignInResult, context: TenantResolverContext): Promise<CommonSignInResult> {\n\t\tconst identityId = signInResult.person.identity_id\n\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\tid: identityId,\n\t\t\troles: signInResult.person.roles,\n\t\t})\n\t\tconst projects = await this.identityTypeResolver.projects(\n\t\t\t{ id: identityId, projects: [] },\n\t\t\t{},\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t...createResolverContext(permissionContext, context.apiKeyId),\n\t\t\t},\n\t\t)\n\t\treturn {\n\t\t\ttoken: signInResult.token,\n\t\t\tperson: PersonResponseFactory.createPersonResponse(signInResult.person, projects),\n\t\t}\n\t}\n}\n"],"names":["createResolverContext","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,sBAAsB;AAAA,EAClC,YACkB,0BACA,sBAChB;AAFgB,SAAA,2BAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eAAe,cAA4B,SAA6D;AACpH,UAAM,aAAa,aAAa,OAAO;AACvC,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAC1E,IAAI;AAAA,MACJ,OAAO,aAAa,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,MAAM,KAAK,qBAAqB;AAAA,MAChD,EAAE,IAAI,YAAY,UAAU,GAAC;AAAA,MAC7B,CAAA;AAAA,MACA;AAAA,QACC,GAAG;AAAA,QACH,GAAGA,6BAAAA,sBAAsB,mBAAmB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC7D;AAED,WAAO;AAAA,MACN,OAAO,aAAa;AAAA,MACpB,QAAQC,sBAAAA,sBAAsB,qBAAqB,aAAa,QAAQ,QAAQ;AAAA,IAAA;AAAA,EAElF;AACD;;"}

package/dist/production/src/resolvers/responseHelpers/SignInResponseFactory.js

@@ -0,0 +1,51 @@
+import "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import "@contember/graphql-utils";
+import { PersonResponseFactory } from "./PersonResponseFactory.js";
+import "@contember/config-loader";
+import { createResolverContext } from "../TenantResolverContextFactory.js";
+class SignInResponseFactory {
+  constructor(permissionContextFactory, identityTypeResolver) {
+    this.permissionContextFactory = permissionContextFactory;
+    this.identityTypeResolver = identityTypeResolver;
+  }
+  async createResponse(signInResult, context) {
+    const identityId = signInResult.person.identity_id;
+    const permissionContext = this.permissionContextFactory.create(context.db, {
+      id: identityId,
+      roles: signInResult.person.roles
+    });
+    const projects = await this.identityTypeResolver.projects(
+      { id: identityId, projects: [] },
+      {},
+      {
+        ...context,
+        ...createResolverContext(permissionContext, context.apiKeyId)
+      }
+    );
+    return {
+      token: signInResult.token,
+      person: PersonResponseFactory.createPersonResponse(signInResult.person, projects)
+    };
+  }
+}
+export {
+  SignInResponseFactory
+};
+//# sourceMappingURL=SignInResponseFactory.js.map

package/dist/production/src/resolvers/responseHelpers/SignInResponseFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/SignInResponseFactory.ts"],"sourcesContent":["import { createResolverContext, IdentityTypeResolver, TenantResolverContext } from '../index'\nimport { PermissionContextFactory, SignInResult } from '../../model'\nimport { CommonSignInResult } from '../../schema'\nimport { PersonResponseFactory } from './PersonResponseFactory'\n\nexport class SignInResponseFactory {\n\tconstructor(\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly identityTypeResolver: IdentityTypeResolver,\n\t) {\n\t}\n\n\tpublic async createResponse(signInResult: SignInResult, context: TenantResolverContext): Promise<CommonSignInResult> {\n\t\tconst identityId = signInResult.person.identity_id\n\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\tid: identityId,\n\t\t\troles: signInResult.person.roles,\n\t\t})\n\t\tconst projects = await this.identityTypeResolver.projects(\n\t\t\t{ id: identityId, projects: [] },\n\t\t\t{},\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t...createResolverContext(permissionContext, context.apiKeyId),\n\t\t\t},\n\t\t)\n\t\treturn {\n\t\t\ttoken: signInResult.token,\n\t\t\tperson: PersonResponseFactory.createPersonResponse(signInResult.person, projects),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,sBAAsB;AAAA,EAClC,YACkB,0BACA,sBAChB;AAFgB,SAAA,2BAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eAAe,cAA4B,SAA6D;AACpH,UAAM,aAAa,aAAa,OAAO;AACvC,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAC1E,IAAI;AAAA,MACJ,OAAO,aAAa,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,MAAM,KAAK,qBAAqB;AAAA,MAChD,EAAE,IAAI,YAAY,UAAU,GAAC;AAAA,MAC7B,CAAA;AAAA,MACA;AAAA,QACC,GAAG;AAAA,QACH,GAAG,sBAAsB,mBAAmB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC7D;AAED,WAAO;AAAA,MACN,OAAO,aAAa;AAAA,MACpB,QAAQ,sBAAsB,qBAAqB,aAAa,QAAQ,QAAQ;AAAA,IAAA;AAAA,EAElF;AACD;"}

package/dist/production/src/resolvers/types/IdentityTypeResolver.cjs

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../model/type/ApiKey.cjs");
+require("@contember/database");
+const batchQuery = require("../../utils/batchQuery.cjs");
+require("node:crypto");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+const PersonByIdentityBatchQuery = require("../../model/queries/person/PersonByIdentityBatchQuery.cjs");
+const IdentityQuery = require("../../model/queries/identity/IdentityQuery.cjs");
+require("node:assert");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const array = require("../../utils/array.cjs");
+const PersonResponseFactory = require("../responseHelpers/PersonResponseFactory.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class IdentityTypeResolver {
+  constructor(projectMemberManager, projectManager, permissionContextFactory) {
+    this.projectMemberManager = projectMemberManager;
+    this.projectManager = projectManager;
+    this.permissionContextFactory = permissionContextFactory;
+    __publicField(this, "personLoader", batchQuery.batchLoader(
+      async (ids, db) => {
+        const persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery.PersonByIdentityBatchQuery(ids));
+        return Object.fromEntries(persons.map((it) => [it.identity_id, it]));
+      },
+      (id, result) => result[id]
+    ));
+    __publicField(this, "rolesLoader", batchQuery.batchLoader(
+      async (ids, db) => {
+        const identities = await db.queryHandler.fetch(new IdentityQuery.IdentityQuery(ids));
+        return Object.fromEntries(identities.map((it) => [it.id, it.roles]));
+      },
+      (id, result) => result[id] ?? []
+    ));
+  }
+  async person(parent, args, context) {
+    const person = await context.db.batchLoad(this.personLoader, parent.id);
+    if (!person) {
+      return null;
+    }
+    return {
+      ...PersonResponseFactory.PersonResponseFactory.createPersonResponse(person),
+      identity: parent
+    };
+  }
+  async projects(parent, {}, context) {
+    if (parent.projects.length > 0) {
+      return parent.projects;
+    }
+    const isSelf = parent.id === context.identity.id;
+    const roles = isSelf ? context.identity.roles : [];
+    const projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext);
+    return (await Promise.all(
+      projects.map(async (it) => {
+        const verifier = isSelf ? void 0 : context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it));
+        const memberships = await this.projectMemberManager.getAllProjectMemberships(
+          context.db,
+          { id: it.id },
+          { id: parent.id, roles },
+          verifier
+        );
+        if (memberships.length === 0) {
+          return null;
+        }
+        return {
+          project: { ...it, members: [], roles: [] },
+          memberships
+        };
+      })
+    )).filter(array.notEmpty);
+  }
+  async roles(parent, {}, context) {
+    if (parent.roles) {
+      return parent.roles;
+    }
+    const isSelf = parent.id === context.identity.id;
+    if (isSelf) {
+      return context.identity.roles;
+    }
+    const canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS });
+    if (canViewRoles) {
+      return await context.db.batchLoad(this.rolesLoader, parent.id);
+    } else {
+      return null;
+    }
+  }
+  async permissions(parent, {}, context) {
+    if (parent.permissions) {
+      return parent.permissions;
+    }
+    const permissionsContext = await (async () => {
+      const isSelf = parent.id === context.identity.id;
+      if (isSelf) {
+        return context.permissionContext;
+      }
+      const roles = await this.roles(parent, {}, context);
+      if (roles === null) {
+        return null;
+      }
+      return this.permissionContextFactory.create(context.db, { id: parent.id, roles });
+    })();
+    if (!permissionsContext) {
+      return null;
+    }
+    return {
+      canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PROJECT_CREATE }),
+      canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY })
+    };
+  }
+}
+exports.IdentityTypeResolver = IdentityTypeResolver;
+//# sourceMappingURL=IdentityTypeResolver.cjs.map

package/dist/production/src/resolvers/types/IdentityTypeResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person } from '../../schema'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { notEmpty } from '../../utils/array'\nimport { batchLoader } from '../../utils/batchQuery'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAAA;AAAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAAA;AAAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAGC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,GAAC;AAAA,UACvC;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AACD;;"}

package/dist/production/src/resolvers/types/IdentityTypeResolver.js

@@ -0,0 +1,125 @@
+import { PermissionActions } from "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../model/type/ApiKey.js";
+import "@contember/database";
+import { batchLoader } from "../../utils/batchQuery.js";
+import "node:crypto";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import { PersonByIdentityBatchQuery } from "../../model/queries/person/PersonByIdentityBatchQuery.js";
+import { IdentityQuery } from "../../model/queries/identity/IdentityQuery.js";
+import "node:assert";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { notEmpty } from "../../utils/array.js";
+import { PersonResponseFactory } from "../responseHelpers/PersonResponseFactory.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class IdentityTypeResolver {
+  constructor(projectMemberManager, projectManager, permissionContextFactory) {
+    this.projectMemberManager = projectMemberManager;
+    this.projectManager = projectManager;
+    this.permissionContextFactory = permissionContextFactory;
+    __publicField(this, "personLoader", batchLoader(
+      async (ids, db) => {
+        const persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids));
+        return Object.fromEntries(persons.map((it) => [it.identity_id, it]));
+      },
+      (id, result) => result[id]
+    ));
+    __publicField(this, "rolesLoader", batchLoader(
+      async (ids, db) => {
+        const identities = await db.queryHandler.fetch(new IdentityQuery(ids));
+        return Object.fromEntries(identities.map((it) => [it.id, it.roles]));
+      },
+      (id, result) => result[id] ?? []
+    ));
+  }
+  async person(parent, args, context) {
+    const person = await context.db.batchLoad(this.personLoader, parent.id);
+    if (!person) {
+      return null;
+    }
+    return {
+      ...PersonResponseFactory.createPersonResponse(person),
+      identity: parent
+    };
+  }
+  async projects(parent, {}, context) {
+    if (parent.projects.length > 0) {
+      return parent.projects;
+    }
+    const isSelf = parent.id === context.identity.id;
+    const roles = isSelf ? context.identity.roles : [];
+    const projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext);
+    return (await Promise.all(
+      projects.map(async (it) => {
+        const verifier = isSelf ? void 0 : context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it));
+        const memberships = await this.projectMemberManager.getAllProjectMemberships(
+          context.db,
+          { id: it.id },
+          { id: parent.id, roles },
+          verifier
+        );
+        if (memberships.length === 0) {
+          return null;
+        }
+        return {
+          project: { ...it, members: [], roles: [] },
+          memberships
+        };
+      })
+    )).filter(notEmpty);
+  }
+  async roles(parent, {}, context) {
+    if (parent.roles) {
+      return parent.roles;
+    }
+    const isSelf = parent.id === context.identity.id;
+    if (isSelf) {
+      return context.identity.roles;
+    }
+    const canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS });
+    if (canViewRoles) {
+      return await context.db.batchLoad(this.rolesLoader, parent.id);
+    } else {
+      return null;
+    }
+  }
+  async permissions(parent, {}, context) {
+    if (parent.permissions) {
+      return parent.permissions;
+    }
+    const permissionsContext = await (async () => {
+      const isSelf = parent.id === context.identity.id;
+      if (isSelf) {
+        return context.permissionContext;
+      }
+      const roles = await this.roles(parent, {}, context);
+      if (roles === null) {
+        return null;
+      }
+      return this.permissionContextFactory.create(context.db, { id: parent.id, roles });
+    })();
+    if (!permissionsContext) {
+      return null;
+    }
+    return {
+      canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
+      canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY })
+    };
+  }
+}
+export {
+  IdentityTypeResolver
+};
+//# sourceMappingURL=IdentityTypeResolver.js.map

package/dist/production/src/resolvers/types/IdentityTypeResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person } from '../../schema'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { notEmpty } from '../../utils/array'\nimport { batchLoader } from '../../utils/batchQuery'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,GAAC;AAAA,UACvC;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AACD;"}

package/dist/production/src/resolvers/types/ProjectTypeResolver.cjs

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/PermissionsFactory.cjs");
+const schema = require("@contember/schema");
+require("../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("node:assert");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+const schemaUtils = require("@contember/schema-utils");
+require("otpauth");
+const graphqlUtils = require("@contember/graphql-utils");
+class ProjectTypeResolver {
+  constructor(projectMemberManager, projectSchemaResolver) {
+    this.projectMemberManager = projectMemberManager;
+    this.projectSchemaResolver = projectSchemaResolver;
+  }
+  async members(parent, args, context) {
+    const projectScope = await context.permissionContext.createProjectScope(parent);
+    const verifier = context.permissionContext.createAccessVerifier(projectScope);
+    if (!await verifier(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]))) {
+      return [];
+    }
+    if (args.input?.filter?.email && args.input.filter.memberType === "API_KEY") {
+      throw new graphqlUtils.UserInputError(`Cannot use email filter for ApiKey member type.`);
+    }
+    if (args.input?.filter?.personId && args.input.filter.memberType === "API_KEY") {
+      throw new graphqlUtils.UserInputError(`Cannot use personId  filter for ApiKey member type.`);
+    }
+    if (args.memberType && args.input) {
+      throw new graphqlUtils.UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`);
+    }
+    const members = await this.projectMemberManager.getProjectMembers(
+      context.db,
+      parent.id,
+      verifier,
+      args.input ?? { filter: { memberType: args.memberType } }
+    );
+    return members.map((it) => ({
+      ...it,
+      identity: { ...it.identity, projects: [] }
+    }));
+  }
+  async roles(parent, args, context) {
+    const schema$1 = await this.projectSchemaResolver.getSchema(parent.slug);
+    if (!schema$1) {
+      return [];
+    }
+    return Object.entries(schema$1.acl.roles).map(([role, def]) => ({
+      name: role,
+      variables: Object.entries(schemaUtils.getRoleVariables(role, schema$1.acl)).map(([name, variableDef]) => {
+        switch (variableDef.type) {
+          case schema.Acl.VariableType.entity:
+            return { __typename: "RoleEntityVariableDefinition", name, entityName: variableDef.entityName };
+          case schema.Acl.VariableType.predefined:
+            return { __typename: "RolePredefinedVariableDefinition", name, value: variableDef.value };
+          case schema.Acl.VariableType.condition:
+            return { __typename: "RoleConditionVariableDefinition", name };
+        }
+      })
+    }));
+  }
+}
+exports.ProjectTypeResolver = ProjectTypeResolver;
+//# sourceMappingURL=ProjectTypeResolver.cjs.map

package/dist/production/src/resolvers/types/ProjectTypeResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAIC,aAAAA,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,EAAC;AAAA,IAAE,EACxC;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAMC,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;;"}

package/dist/production/src/resolvers/types/ProjectTypeResolver.js

@@ -0,0 +1,74 @@
+import { PermissionActions } from "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/PermissionsFactory.js";
+import { Acl } from "@contember/schema";
+import "../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import { getRoleVariables } from "@contember/schema-utils";
+import "otpauth";
+import { UserInputError } from "@contember/graphql-utils";
+class ProjectTypeResolver {
+  constructor(projectMemberManager, projectSchemaResolver) {
+    this.projectMemberManager = projectMemberManager;
+    this.projectSchemaResolver = projectSchemaResolver;
+  }
+  async members(parent, args, context) {
+    const projectScope = await context.permissionContext.createProjectScope(parent);
+    const verifier = context.permissionContext.createAccessVerifier(projectScope);
+    if (!await verifier(PermissionActions.PROJECT_VIEW_MEMBER([]))) {
+      return [];
+    }
+    if (args.input?.filter?.email && args.input.filter.memberType === "API_KEY") {
+      throw new UserInputError(`Cannot use email filter for ApiKey member type.`);
+    }
+    if (args.input?.filter?.personId && args.input.filter.memberType === "API_KEY") {
+      throw new UserInputError(`Cannot use personId  filter for ApiKey member type.`);
+    }
+    if (args.memberType && args.input) {
+      throw new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`);
+    }
+    const members = await this.projectMemberManager.getProjectMembers(
+      context.db,
+      parent.id,
+      verifier,
+      args.input ?? { filter: { memberType: args.memberType } }
+    );
+    return members.map((it) => ({
+      ...it,
+      identity: { ...it.identity, projects: [] }
+    }));
+  }
+  async roles(parent, args, context) {
+    const schema = await this.projectSchemaResolver.getSchema(parent.slug);
+    if (!schema) {
+      return [];
+    }
+    return Object.entries(schema.acl.roles).map(([role, def]) => ({
+      name: role,
+      variables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {
+        switch (variableDef.type) {
+          case Acl.VariableType.entity:
+            return { __typename: "RoleEntityVariableDefinition", name, entityName: variableDef.entityName };
+          case Acl.VariableType.predefined:
+            return { __typename: "RolePredefinedVariableDefinition", name, value: variableDef.value };
+          case Acl.VariableType.condition:
+            return { __typename: "RoleConditionVariableDefinition", name };
+        }
+      })
+    }));
+  }
+}
+export {
+  ProjectTypeResolver
+};
+//# sourceMappingURL=ProjectTypeResolver.js.map

package/dist/production/src/resolvers/types/ProjectTypeResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAOO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAI,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAI,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAI,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,EAAC;AAAA,IAAE,EACxC;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;"}

package/dist/production/src/schema/index.cjs

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=index.cjs.map

package/dist/production/src/schema/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":""}

package/dist/production/src/schema/index.js

@@ -0,0 +1,2 @@
+
+//# sourceMappingURL=index.js.map

package/dist/production/src/schema/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}