@contember/engine-tenant-api 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class PasswordlessMutationResolver {
+  constructor(passwordlessSignInManager, signInResponseFactory) {
+    this.passwordlessSignInManager = passwordlessSignInManager;
+    this.signInResponseFactory = signInResponseFactory;
+  }
+  async initSignInPasswordless(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,
+      message: "You are not allowed to request passwordless sign in"
+    });
+    const result = await this.passwordlessSignInManager.initSignInPasswordless({
+      db: context.db,
+      permissionContext: context.permissionContext,
+      email: args.email,
+      mailVariant: args.options?.mailVariant ?? void 0,
+      mailProject: args.options?.mailProject ?? void 0
+    });
+    await context.logAuthAction({
+      type: "passwordless_login_init",
+      response: result
+    });
+    if (!result.ok) {
+      if (result.error === "PERSON_NOT_FOUND") {
+        const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+        if (!configuration.login.revealUserExists) {
+          return errorUtils.createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+        }
+      }
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true, result: result.result };
+  }
+  async signInPasswordless(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+      message: "You are not allowed to sign in using passwordless"
+    });
+    const signIn = await this.passwordlessSignInManager.signInPasswordless({
+      db: context.db,
+      requestId: args.requestId,
+      token: args.token,
+      mfaOtp: args.mfaOtp ?? void 0,
+      validationType: args.validationType,
+      expiration: args.expiration ?? void 0
+    });
+    await context.logAuthAction({
+      type: "passwordless_login",
+      response: signIn
+    });
+    if (!signIn.ok) {
+      return errorUtils.createErrorResponse(signIn.error, signIn.errorMessage);
+    }
+    return {
+      ok: true,
+      result: await this.signInResponseFactory.createResponse(signIn.result, context)
+    };
+  }
+  async activatePasswordlessOtp(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+      message: "You are not allowed to activate passwordless OTP"
+    });
+    const result = await this.passwordlessSignInManager.activatePasswordlessOtp({
+      db: context.db,
+      requestId: args.requestId,
+      token: args.token,
+      otpHash: args.otpHash
+    });
+    await context.logAuthAction({
+      type: "passwordless_login_exchange",
+      response: result
+    });
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+exports.PasswordlessMutationResolver = PasswordlessMutationResolver;
+//# sourceMappingURL=PasswordlessMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND') {\n\t\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,oBAAoB;AACxC,cAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,YAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,iBAAOC,WAAAA,oBAAoB,yBAAyB,kDAAkD;AAAA,QACvG;AAAA,MACD;AAEA,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js

@@ -0,0 +1,102 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class PasswordlessMutationResolver {
+  constructor(passwordlessSignInManager, signInResponseFactory) {
+    this.passwordlessSignInManager = passwordlessSignInManager;
+    this.signInResponseFactory = signInResponseFactory;
+  }
+  async initSignInPasswordless(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,
+      message: "You are not allowed to request passwordless sign in"
+    });
+    const result = await this.passwordlessSignInManager.initSignInPasswordless({
+      db: context.db,
+      permissionContext: context.permissionContext,
+      email: args.email,
+      mailVariant: args.options?.mailVariant ?? void 0,
+      mailProject: args.options?.mailProject ?? void 0
+    });
+    await context.logAuthAction({
+      type: "passwordless_login_init",
+      response: result
+    });
+    if (!result.ok) {
+      if (result.error === "PERSON_NOT_FOUND") {
+        const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
+        if (!configuration.login.revealUserExists) {
+          return createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+        }
+      }
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true, result: result.result };
+  }
+  async signInPasswordless(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+      message: "You are not allowed to sign in using passwordless"
+    });
+    const signIn = await this.passwordlessSignInManager.signInPasswordless({
+      db: context.db,
+      requestId: args.requestId,
+      token: args.token,
+      mfaOtp: args.mfaOtp ?? void 0,
+      validationType: args.validationType,
+      expiration: args.expiration ?? void 0
+    });
+    await context.logAuthAction({
+      type: "passwordless_login",
+      response: signIn
+    });
+    if (!signIn.ok) {
+      return createErrorResponse(signIn.error, signIn.errorMessage);
+    }
+    return {
+      ok: true,
+      result: await this.signInResponseFactory.createResponse(signIn.result, context)
+    };
+  }
+  async activatePasswordlessOtp(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
+      message: "You are not allowed to activate passwordless OTP"
+    });
+    const result = await this.passwordlessSignInManager.activatePasswordlessOtp({
+      db: context.db,
+      requestId: args.requestId,
+      token: args.token,
+      otpHash: args.otpHash
+    });
+    await context.logAuthAction({
+      type: "passwordless_login_exchange",
+      response: result
+    });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+export {
+  PasswordlessMutationResolver
+};
+//# sourceMappingURL=PasswordlessMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND') {\n\t\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,oBAAoB;AACxC,cAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,YAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,iBAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,QACvG;AAAA,MACD;AAEA,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class ResetPasswordMutationResolver {
+  constructor(passwordResetManager, permissionContextFactory) {
+    this.passwordResetManager = passwordResetManager;
+    this.permissionContextFactory = permissionContextFactory;
+  }
+  async createResetPasswordRequest(parent, args, context, info) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_RESET_PASSWORD,
+      message: "You are not allowed to initialize reset password request"
+    });
+    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(args.email));
+    if (!person) {
+      const responseError = new Response.ResponseError("PERSON_NOT_FOUND", `Person with email ${args.email} was not found.`);
+      await context.logAuthAction({
+        type: "password_reset_init",
+        response: responseError,
+        personInput: args.email
+      });
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      if (!configuration.login.revealUserExists) {
+        return { ok: true, errors: [] };
+      }
+      return errorUtils.createErrorResponse(responseError);
+    }
+    const permissionContext = await this.permissionContextFactory.create(context.db, {
+      id: person.identity_id,
+      roles: person.roles
+    });
+    await this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {
+      mailVariant: args.options?.mailVariant || void 0,
+      project: args.options?.mailProject || void 0
+    });
+    await context.logAuthAction({
+      type: "password_reset_init",
+      response: new Response.ResponseOk(null),
+      personInput: args.email,
+      personId: person.id
+    });
+    return { ok: true, errors: [] };
+  }
+  async resetPassword(parent, args, context, info) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_RESET_PASSWORD,
+      message: "You are not allowed to perform reset password reset"
+    });
+    const result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password);
+    await context.logAuthAction({
+      type: "password_reset",
+      response: result
+    });
+    if (result.ok) {
+      return { ok: true, errors: [] };
+    }
+    return errorUtils.createErrorResponse(result);
+  }
+}
+exports.ResetPasswordMutationResolver = ResetPasswordMutationResolver;
+//# sourceMappingURL=ResetPasswordMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","ResponseError","ConfigurationQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAIC,SAAAA,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAOC,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAOI,WAAAA,oBAAoB,MAAM;AAAA,EAClC;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js

@@ -0,0 +1,82 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class ResetPasswordMutationResolver {
+  constructor(passwordResetManager, permissionContextFactory) {
+    this.passwordResetManager = passwordResetManager;
+    this.permissionContextFactory = permissionContextFactory;
+  }
+  async createResetPasswordRequest(parent, args, context, info) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_RESET_PASSWORD,
+      message: "You are not allowed to initialize reset password request"
+    });
+    const person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email));
+    if (!person) {
+      const responseError = new ResponseError("PERSON_NOT_FOUND", `Person with email ${args.email} was not found.`);
+      await context.logAuthAction({
+        type: "password_reset_init",
+        response: responseError,
+        personInput: args.email
+      });
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
+      if (!configuration.login.revealUserExists) {
+        return { ok: true, errors: [] };
+      }
+      return createErrorResponse(responseError);
+    }
+    const permissionContext = await this.permissionContextFactory.create(context.db, {
+      id: person.identity_id,
+      roles: person.roles
+    });
+    await this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {
+      mailVariant: args.options?.mailVariant || void 0,
+      project: args.options?.mailProject || void 0
+    });
+    await context.logAuthAction({
+      type: "password_reset_init",
+      response: new ResponseOk(null),
+      personInput: args.email,
+      personId: person.id
+    });
+    return { ok: true, errors: [] };
+  }
+  async resetPassword(parent, args, context, info) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_RESET_PASSWORD,
+      message: "You are not allowed to perform reset password reset"
+    });
+    const result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password);
+    await context.logAuthAction({
+      type: "password_reset",
+      response: result
+    });
+    if (result.ok) {
+      return { ok: true, errors: [] };
+    }
+    return createErrorResponse(result);
+  }
+}
+export {
+  ResetPasswordMutationResolver
+};
+//# sourceMappingURL=ResetPasswordMutationResolver.js.map

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+require("../../../model/type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+require("node:assert");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("@contember/schema-utils");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+const graphqlUtils = require("@contember/graphql-utils");
+const NextLoginAttemptQuery = require("../../../model/queries/authLog/NextLoginAttemptQuery.cjs");
+class SignInMutationResolver {
+  constructor(signInManager, signInResponseFactory) {
+    this.signInManager = signInManager;
+    this.signInResponseFactory = signInResponseFactory;
+  }
+  async signIn(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_SIGN_IN,
+      message: "You are not allowed to sign in"
+    });
+    const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery.NextLoginAttemptQuery(args.email));
+    if (nextAllowedSignIn > /* @__PURE__ */ new Date()) {
+      return errorUtils.createErrorResponse(
+        new Response.ResponseError("RATE_LIMIT_EXCEEDED", `Too many attempts, please try again later.`, {
+          retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1e3)
+        })
+      );
+    }
+    const response = await this.signInManager.signIn(
+      context.db,
+      args.email,
+      args.password,
+      args.expiration || void 0,
+      args.otpToken || void 0
+    );
+    await context.logAuthAction({
+      type: "login",
+      response
+    });
+    if (!response.ok) {
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
+        return errorUtils.createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
+      }
+      return errorUtils.createErrorResponse(response.error, response.errorMessage);
+    }
+    return {
+      ok: true,
+      errors: [],
+      result: await this.signInResponseFactory.createResponse(response.result, context)
+    };
+  }
+  async createSessionToken(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(),
+      message: "You are not allowed to create a session key"
+    });
+    let identifier;
+    if (args.email) {
+      identifier = { type: "email", email: args.email };
+    } else if (args.personId) {
+      identifier = { type: "id", id: args.personId };
+    } else {
+      throw new graphqlUtils.UserInputError(`Please provide either email or personId`);
+    }
+    const response = await this.signInManager.createSessionToken(
+      context.db,
+      identifier,
+      args.expiration || void 0,
+      async (person) => await context.requireAccess({
+        action: PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
+        message: "You are not allowed to create a session key for this person."
+      })
+    );
+    await context.logAuthAction({
+      type: "create_session_token",
+      response
+    });
+    if (!response.ok) {
+      return errorUtils.createErrorResponse(response.error, response.errorMessage);
+    }
+    return {
+      ok: true,
+      result: await this.signInResponseFactory.createResponse(response.result, context)
+    };
+  }
+}
+exports.SignInMutationResolver = SignInMutationResolver;
+//# sourceMappingURL=SignInMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'\nimport { ResponseError } from '../../../model/utils/Response'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (\n\t\t\t\t!configuration.login.revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\t) {\n\t\t\t\t// if the user does not exist, we don't want to reveal that, so we return a generic error\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","NextLoginAttemptQuery","createErrorResponse","ResponseError","ConfigurationQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAOC,WAAAA;AAAAA,QACN,IAAIC,uBAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UACC,CAAC,cAAc,MAAM,oBAClB,CAAC,mBAAmB,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK,GACxH;AAED,eAAOF,WAAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AACA,aAAOA,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQL,kBAAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,IAAA;AAEH,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js

@@ -0,0 +1,104 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { ResponseError } from "../../../model/utils/Response.js";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import "node:assert";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+import { UserInputError } from "@contember/graphql-utils";
+import { NextLoginAttemptQuery } from "../../../model/queries/authLog/NextLoginAttemptQuery.js";
+class SignInMutationResolver {
+  constructor(signInManager, signInResponseFactory) {
+    this.signInManager = signInManager;
+    this.signInResponseFactory = signInResponseFactory;
+  }
+  async signIn(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_SIGN_IN,
+      message: "You are not allowed to sign in"
+    });
+    const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email));
+    if (nextAllowedSignIn > /* @__PURE__ */ new Date()) {
+      return createErrorResponse(
+        new ResponseError("RATE_LIMIT_EXCEEDED", `Too many attempts, please try again later.`, {
+          retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1e3)
+        })
+      );
+    }
+    const response = await this.signInManager.signIn(
+      context.db,
+      args.email,
+      args.password,
+      args.expiration || void 0,
+      args.otpToken || void 0
+    );
+    await context.logAuthAction({
+      type: "login",
+      response
+    });
+    if (!response.ok) {
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
+      if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
+        return createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
+      }
+      return createErrorResponse(response.error, response.errorMessage);
+    }
+    return {
+      ok: true,
+      errors: [],
+      result: await this.signInResponseFactory.createResponse(response.result, context)
+    };
+  }
+  async createSessionToken(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_CREATE_SESSION_KEY(),
+      message: "You are not allowed to create a session key"
+    });
+    let identifier;
+    if (args.email) {
+      identifier = { type: "email", email: args.email };
+    } else if (args.personId) {
+      identifier = { type: "id", id: args.personId };
+    } else {
+      throw new UserInputError(`Please provide either email or personId`);
+    }
+    const response = await this.signInManager.createSessionToken(
+      context.db,
+      identifier,
+      args.expiration || void 0,
+      async (person) => await context.requireAccess({
+        action: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
+        message: "You are not allowed to create a session key for this person."
+      })
+    );
+    await context.logAuthAction({
+      type: "create_session_token",
+      response
+    });
+    if (!response.ok) {
+      return createErrorResponse(response.error, response.errorMessage);
+    }
+    return {
+      ok: true,
+      result: await this.signInResponseFactory.createResponse(response.result, context)
+    };
+  }
+}
+export {
+  SignInMutationResolver
+};
+//# sourceMappingURL=SignInMutationResolver.js.map