@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.1

package/dist/development/src/resolvers/types/IdentityTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import {\n\tIdentity,\n\tIdentityGlobalPermissions,\n\tIdentityProjectRelation,\n\tIdentityResolvers,\n\tMaybe,\n\tPerson,\n} from '../../schema'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { notEmpty } from '../../utils/array'\nimport { batchLoader } from '../../utils/batchQuery'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAA;AAAA,MACtB,OAAO,KAAK,OAAO;AACZ,cAAA,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AACxE,eAAA,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAA;AAAA,MACrB,OAAO,KAAK,OAAO;AACZ,cAAA,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AAC9D,eAAA,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAAA;AAAA,EASA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AAC/F,UAAA,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACL,aAAA;AAAA,IAAA;AAED,WAAA;AAAA,MACN,GAAGC,sBAAsB,sBAAA,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IACX;AAAA,EAAA;AAAA,EAGD,MAAM,SACL,QACA,IACA,SAC8C;AAC1C,QAAA,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IAAA;AAEf,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAC;AAC3C,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AAC7D,cAAA,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AAClG,cAAA,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAG;AAAA,UACZ,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UACvB;AAAA,QACD;AACI,YAAA,YAAY,WAAW,GAAG;AACtB,iBAAA;AAAA,QAAA;AAED,eAAA;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,OAAO,GAAG;AAAA,UACzC;AAAA,QACD;AAAA,MACA,CAAA;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAAA;AAAA,EAGlB,MAAM,MACL,QACA,IACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IAAA;AAEf,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IAAA;AAEnB,UAAA,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAAA,OACvD;AACC,aAAA;AAAA,IAAA;AAAA,EACR;AAAA,EAGD,MAAM,YACL,QACA,IACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IAAA;AAGT,UAAA,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAAA;AAEhB,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACZ,eAAA;AAAA,MAAA;AAED,aAAA,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IAAA,GAC9E;AAEH,QAAI,CAAC,oBAAoB;AACjB,aAAA;AAAA,IAAA;AAGD,WAAA;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAA,kBAAkB,kBAAmB,CAAA;AAAA,IACxG;AAAA,EAAA;AAEF;;"}
+{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person } from '../../schema'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { notEmpty } from '../../utils/array'\nimport { batchLoader } from '../../utils/batchQuery'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAAA;AAAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAAA;AAAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAGC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,GAAC;AAAA,UACvC;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AACD;;"}

package/dist/development/src/resolvers/types/IdentityTypeResolver.js

@@ -16,6 +16,7 @@ import "openid-client";
 import "@contember/typesafe";
 import "../../model/service/idp/providers/OIDCTypes.js";
 import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { notEmpty } from "../../utils/array.js";

package/dist/development/src/resolvers/types/IdentityTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import {\n\tIdentity,\n\tIdentityGlobalPermissions,\n\tIdentityProjectRelation,\n\tIdentityResolvers,\n\tMaybe,\n\tPerson,\n} from '../../schema'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { notEmpty } from '../../utils/array'\nimport { batchLoader } from '../../utils/batchQuery'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AACZ,cAAA,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AACxE,eAAA,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AACZ,cAAA,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AAC9D,eAAA,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAAA;AAAA,EASA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AAC/F,UAAA,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACL,aAAA;AAAA,IAAA;AAED,WAAA;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IACX;AAAA,EAAA;AAAA,EAGD,MAAM,SACL,QACA,IACA,SAC8C;AAC1C,QAAA,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IAAA;AAEf,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAC;AAC3C,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AAC7D,cAAA,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AAClG,cAAA,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAG;AAAA,UACZ,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UACvB;AAAA,QACD;AACI,YAAA,YAAY,WAAW,GAAG;AACtB,iBAAA;AAAA,QAAA;AAED,eAAA;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,OAAO,GAAG;AAAA,UACzC;AAAA,QACD;AAAA,MACA,CAAA;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAAA;AAAA,EAGlB,MAAM,MACL,QACA,IACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IAAA;AAEf,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IAAA;AAEnB,UAAA,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAAA,OACvD;AACC,aAAA;AAAA,IAAA;AAAA,EACR;AAAA,EAGD,MAAM,YACL,QACA,IACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IAAA;AAGT,UAAA,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAAA;AAEhB,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACZ,eAAA;AAAA,MAAA;AAED,aAAA,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IAAA,GAC9E;AAEH,QAAI,CAAC,oBAAoB;AACjB,aAAA;AAAA,IAAA;AAGD,WAAA;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,kBAAmB,CAAA;AAAA,IACxG;AAAA,EAAA;AAEF;"}
+{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person } from '../../schema'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { notEmpty } from '../../utils/array'\nimport { batchLoader } from '../../utils/batchQuery'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,GAAC;AAAA,UACvC;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AACD;"}

package/dist/development/src/resolvers/types/ProjectTypeResolver.cjs

@@ -15,6 +15,7 @@ require("openid-client");
 require("@contember/typesafe");
 require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
 const schemaUtils = require("@contember/schema-utils");
 require("otpauth");
 const graphqlUtils = require("@contember/graphql-utils");
@@ -38,7 +39,12 @@ class ProjectTypeResolver {
     if (args.memberType && args.input) {
       throw new graphqlUtils.UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`);
     }
-    const members = await this.projectMemberManager.getProjectMembers(context.db, parent.id, verifier, args.input ?? { filter: { memberType: args.memberType } });
+    const members = await this.projectMemberManager.getProjectMembers(
+      context.db,
+      parent.id,
+      verifier,
+      args.input ?? { filter: { memberType: args.memberType } }
+    );
     return members.map((it) => ({
       ...it,
       identity: { ...it.identity, projects: [] }

package/dist/development/src/resolvers/types/ProjectTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync members(\n\t\tparent: Project,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, parent.id, verifier, args.input ?? { filter: { memberType: args.memberType } })\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Project, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;AAOO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AACxE,QAAA,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAC;AAAA,IAAA;AAEL,QAAA,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AACtE,YAAA,IAAIC,aAAAA,eAAe,iDAAiD;AAAA,IAAA;AAEvE,QAAA,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AACzE,YAAA,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAAA;AAE3E,QAAA,KAAK,cAAc,KAAK,OAAO;AAC5B,YAAA,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IAAA;AAGnG,UAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,OAAO,IAAI,UAAU,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,WAAA,GAAc;AACrJ,WAAA,QAAQ,IAAI,CAAO,QAAA;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAG,EAAA;AAAA,IAAA,EACxC;AAAA,EAAA;AAAA,EAGH,MAAM,MAAM,QAAiB,MAAe,SAAgC;AAC3E,UAAMC,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAM;AAAA,UACzB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAW;AAAA,UACxG,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAM;AAAA,UAClG,KAAKA,OAAAA,IAAI,aAAa;AACd,mBAAA,EAAE,YAAY,mCAA4C,KAAK;AAAA,QAAA;AAAA,MAExE,CAAA;AAAA,IAAA,EACA;AAAA,EAAA;AAEJ;;"}
+{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAIC,aAAAA,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,EAAC;AAAA,IAAE,EACxC;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAMC,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;;"}

package/dist/development/src/resolvers/types/ProjectTypeResolver.js

@@ -13,6 +13,7 @@ import "openid-client";
 import "@contember/typesafe";
 import "../../model/service/idp/providers/OIDCTypes.js";
 import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
 import { getRoleVariables } from "@contember/schema-utils";
 import "otpauth";
 import { UserInputError } from "@contember/graphql-utils";
@@ -36,7 +37,12 @@ class ProjectTypeResolver {
     if (args.memberType && args.input) {
       throw new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`);
     }
-    const members = await this.projectMemberManager.getProjectMembers(context.db, parent.id, verifier, args.input ?? { filter: { memberType: args.memberType } });
+    const members = await this.projectMemberManager.getProjectMembers(
+      context.db,
+      parent.id,
+      verifier,
+      args.input ?? { filter: { memberType: args.memberType } }
+    );
     return members.map((it) => ({
       ...it,
       identity: { ...it.identity, projects: [] }

package/dist/development/src/resolvers/types/ProjectTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync members(\n\t\tparent: Project,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, parent.id, verifier, args.input ?? { filter: { memberType: args.memberType } })\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Project, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAOO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AACxE,QAAA,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAC;AAAA,IAAA;AAEL,QAAA,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AACtE,YAAA,IAAI,eAAe,iDAAiD;AAAA,IAAA;AAEvE,QAAA,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AACzE,YAAA,IAAI,eAAe,qDAAqD;AAAA,IAAA;AAE3E,QAAA,KAAK,cAAc,KAAK,OAAO;AAC5B,YAAA,IAAI,eAAe,yEAAyE;AAAA,IAAA;AAGnG,UAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,OAAO,IAAI,UAAU,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,WAAA,GAAc;AACrJ,WAAA,QAAQ,IAAI,CAAO,QAAA;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAG,EAAA;AAAA,IAAA,EACxC;AAAA,EAAA;AAAA,EAGH,MAAM,MAAM,QAAiB,MAAe,SAAgC;AAC3E,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAM;AAAA,UACzB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAW;AAAA,UACxG,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAM;AAAA,UAClG,KAAK,IAAI,aAAa;AACd,mBAAA,EAAE,YAAY,mCAA4C,KAAK;AAAA,QAAA;AAAA,MAExE,CAAA;AAAA,IAAA,EACA;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAOO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAI,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAI,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAI,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,EAAC;AAAA,IAAE,EACxC;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;"}

package/dist/development/src/schema/tenant.graphql.cjs

@@ -3,6 +3,9 @@ const graphqlTag = require("graphql-tag");
 const schema = graphqlTag.gql`
 	scalar Json
 	scalar DateTime
+	
+	""" Interval is a string in the format ISO 8601, e.g. "PT1H" for 1 hour """
+	scalar Interval
 
 	schema {
 		query: Query
@@ -119,16 +122,39 @@ const schema = graphqlTag.gql`
 	
 	type Config {
 		passwordless: ConfigPasswordless!
+		password: ConfigPassword!
+		login: ConfigLogin!
 	}
 	
 	type ConfigPasswordless {
 		enabled: ConfigPolicy!
 		url: String
-		expirationMinutes: Int!
+		expiration: Interval!
 	}
 	
+	type ConfigPassword {
+		minLength: Int!
+		requireUppercase: Int!
+		requireLowercase: Int!
+		requireDigit: Int!
+		requireSpecial: Int!
+		pattern: String
+		checkBlacklist: Boolean!
+    }
+	
+	type ConfigLogin {
+		baseBackoff: Interval!
+		maxBackoff: Interval!
+		attemptWindow: Interval!
+		revealUserExists: Boolean!
+		defaultTokenExpiration: Interval!
+		maxTokenExpiration: Interval
+    }
+	
 	input ConfigInput {
 		passwordless: ConfigPasswordlessInput
+		password: ConfigPasswordInput
+		login: ConfigLoginInput
 	}
 	
 	enum ConfigPolicy {
@@ -141,9 +167,28 @@ const schema = graphqlTag.gql`
 	input ConfigPasswordlessInput {
 		enabled: ConfigPolicy
 		url: String
-		expirationMinutes: Int
+		expiration: Interval
 	}
 	
+	input ConfigPasswordInput {
+		minLength: Int
+		requireUppercase: Int
+		requireLowercase: Int
+		requireDigit: Int
+		requireSpecial: Int
+		pattern: String
+		checkBlacklist: Boolean
+    }
+	
+	input ConfigLoginInput {
+		baseBackoff: Interval
+		maxBackoff: Interval
+		attemptWindow: Interval
+		revealUserExists: Boolean
+		defaultTokenExpiration: Interval
+		maxTokenExpiration: Interval
+    }
+	
 	type ConfigureResponse {
 		ok: Boolean!
 		error: ConfigureError
@@ -168,6 +213,7 @@ const schema = graphqlTag.gql`
 
 	type SignUpError {
 		code: SignUpErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endPersonMessage: String @deprecated
 	}
@@ -201,15 +247,18 @@ const schema = graphqlTag.gql`
 		code: SignInErrorCode!
 		developerMessage: String!
 		endUserMessage: String @deprecated
+		retryAfter: Int
 	}
 
 	enum SignInErrorCode {
+		INVALID_CREDENTIALS
 		UNKNOWN_EMAIL
 		INVALID_PASSWORD
 		PERSON_DISABLED
 		NO_PASSWORD_SET
 		OTP_REQUIRED
 		INVALID_OTP_TOKEN
+		RATE_LIMIT_EXCEEDED
 	}
 
 	type SignInResult implements CommonSignInResult {
@@ -306,6 +355,7 @@ const schema = graphqlTag.gql`
 
 	type ChangePasswordError {
 		code: ChangePasswordErrorCode!
+		weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endUserMessage: String @deprecated
 	}
@@ -314,6 +364,16 @@ const schema = graphqlTag.gql`
 		PERSON_NOT_FOUND
 		TOO_WEAK
 	}
+	
+	enum WeakPasswordReason {
+		TOO_SHORT
+		MISSING_UPPERCASE
+		MISSING_LOWERCASE
+		MISSING_DIGIT
+		MISSING_SPECIAL
+		INVALID_PATTERN
+		BLACKLISTED
+    }
 
 
 	# === changeMyPassword ===
@@ -325,6 +385,7 @@ const schema = graphqlTag.gql`
 
 	type ChangeMyPasswordError {
 		code: ChangeMyPasswordErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 	}
 
@@ -1085,6 +1146,7 @@ const schema = graphqlTag.gql`
 	}
 	type ResetPasswordError {
 		code: ResetPasswordErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endUserMessage: String @deprecated
 	}

package/dist/development/src/schema/tenant.graphql.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.graphql.cjs","sources":["../../../../../packages/engine-tenant-api/src/schema/tenant.graphql.ts"],"sourcesContent":["import { gql } from 'graphql-tag'\nimport { DocumentNode } from 'graphql'\n\nconst schema: DocumentNode = gql`\n\tscalar Json\n\tscalar DateTime\n\n\tschema {\n\t\tquery: Query\n\t\tmutation: Mutation\n\t}\n\n\ttype Query {\n\t\tme: Identity!\n\t\tpersonById(id: String!): Person\n\t\tprojects: [Project!]!\n\t\tprojectBySlug(slug: String!): Project\n\t\tprojectMemberships(projectSlug: String!, identityId: String!): [Membership!]!\n\t\tcheckResetPasswordToken(requestId: String!, token: String!): CheckResetPasswordTokenCode!\n\n\t\tidentityProviders: [IdentityProvider!]!\n\t\tmailTemplates: [MailTemplateData!]!\n\t\t\n\t\tconfiguration: Config!\n\t}\n\n\ttype Mutation {\n\t\tsignUp(email: String!, password: String, passwordHash: String, roles: [String!], name: String): SignUpResponse\n\t\tsignIn(email: String!, password: String!, expiration: Int, otpToken: String): SignInResponse\n\t\tcreateSessionToken(email: String, personId: String, expiration: Int): CreateSessionTokenResponse\n\t\tsignOut(all: Boolean): SignOutResponse\n\t\tchangeProfile(personId: String!, email: String, name: String): ChangeProfileResponse\n\t\tchangeMyProfile(email: String, name: String): ChangeMyProfileResponse\n\t\tchangePassword(personId: String!, password: String!): ChangePasswordResponse\n\t\tchangeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse\n\n\t\tinitSignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\")\n\t\t): InitSignInIDPResponse\n\t\tsignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json,\n\t\t\texpiration: Int\n\t\t\tidpResponse: IDPResponseInput, @deprecated(reason: \"pass idpResponse.url as data.url\")\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\"),\n\t\t\tsessionData: Json @deprecated(reason: \"use data.sessionData\"),\n\t\t): SignInIDPResponse\n\t\t\n\t\t# passwordless sign in\n\t\tinitSignInPasswordless(email: String!, options: InitSignInPasswordlessOptions): InitSignInPasswordlessResponse\n\t\tsignInPasswordless(requestId: String!, validationType: PasswordlessValidationType!, token: String!, expiration: Int, mfaOtp: String): SignInPasswordlessResponse\n\t\tactivatePasswordlessOtp(requestId: String!, token: String!, otpHash: String!): ActivatePasswordlessOtpResponse\n\n        enableMyPasswordless: ToggleMyPasswordlessResponse\n        disableMyPasswordless: ToggleMyPasswordlessResponse\n\n\t\t# IDP management\n\t\taddIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse\n\t\tupdateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions, mergeConfiguration: Boolean): UpdateIDPResponse\n\t\tdisableIDP(identityProvider: String!): DisableIDPResponse\n\t\tenableIDP(identityProvider: String!): EnableIDPResponse\n\n\t\tprepareOtp(label: String): PrepareOtpResponse\n\t\tconfirmOtp(otpToken: String!): ConfirmOtpResponse\n\t\tdisableOtp: DisableOtpResponse\n\n\t\tdisablePerson(personId: String!): DisablePersonResponse\n\n\t\tcreateResetPasswordRequest(email: String!, options: CreateResetPasswordRequestOptions): CreatePasswordResetRequestResponse\n\t\tresetPassword(token: String!, password: String!): ResetPasswordResponse\n\n\t\tinvite(email: String!, name: String, projectSlug: String!, memberships: [MembershipInput!]!, options: InviteOptions): InviteResponse\n\t\tunmanagedInvite(\n\t\t\temail: String!,\n\t\t\tname: String,\n\t\t\tprojectSlug: String!,\n\t\t\tmemberships: [MembershipInput!]!,\n\t\t\toptions: UnmanagedInviteOptions,\n\t\t\tpassword: String @deprecated(reason: \"Use options\")\n\t\t): InviteResponse\n\n\t\taddProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): AddProjectMemberResponse\n\t\tremoveProjectMember(projectSlug: String!, identityId: String!): RemoveProjectMemberResponse\n\n\t\tupdateProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): UpdateProjectMemberResponse\n\n\t\tcreateApiKey(projectSlug: String!, memberships: [MembershipInput!]!, description: String!, tokenHash: String): CreateApiKeyResponse\n\t\tcreateGlobalApiKey(description: String!, roles: [String!], tokenHash: String): CreateApiKeyResponse\n\t\tdisableApiKey(id: String!): DisableApiKeyResponse\n\t\taddGlobalIdentityRoles(identityId: String!, roles: [String!]!): AddGlobalIdentityRolesResponse\n\t\tremoveGlobalIdentityRoles(identityId: String!, roles: [String!]!): RemoveGlobalIdentityRolesResponse\n\n\t\taddMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\tremoveMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\n\t\tcreateProject(\n\t\t\tprojectSlug: String!,\n\t\t\tname: String,\n\t\t\tconfig: Json,\n\t\t\tsecrets: [ProjectSecret!],\n\t\t\toptions: CreateProjectOptions,\n\t\t\tdeployTokenHash: String @deprecated(reason: \"Use options\")\n\t\t): CreateProjectResponse\n\t\tsetProjectSecret(projectSlug: String!, key: String!, value: String!): SetProjectSecretResponse\n\t\tupdateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse\n\t\t\n\t\tconfigure(config: ConfigInput!): ConfigureResponse\n\n\t\taddProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\t@deprecated(reason: \"use addMailTemplate\")\n\n\t\tremoveProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\t\t@deprecated(reason: \"use removeMailTemplate\")\n\n\t}\n\t\n\t# === configure ===\n\t\n\ttype Config {\n\t\tpasswordless: ConfigPasswordless!\n\t}\n\t\n\ttype ConfigPasswordless {\n\t\tenabled: ConfigPolicy!\n\t\turl: String\n\t\texpirationMinutes: Int!\n\t}\n\t\n\tinput ConfigInput {\n\t\tpasswordless: ConfigPasswordlessInput\n\t}\n\t\n\tenum ConfigPolicy {\n\t\talways\n\t\tnever\n\t\toptIn\n\t\toptOut\n\t}\n\t\n\tinput ConfigPasswordlessInput {\n\t\tenabled: ConfigPolicy\n\t\turl: String\n\t\texpirationMinutes: Int\n\t}\n\t\n\ttype ConfigureResponse {\n\t\tok: Boolean!\n\t\terror: ConfigureError\n\t}\n\t\n\ttype ConfigureError {\n\t\tcode: ConfigureErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ConfigureErrorCode {\n\t\tINVALID_CONFIG\n\t}\n\n\t# === signUp ===\n\ttype SignUpResponse {\n\t\tok: Boolean!\n\t\terrors: [SignUpError!]! @deprecated\n\t\terror: SignUpError\n\t\tresult: SignUpResult\n\t}\n\n\ttype SignUpError {\n\t\tcode: SignUpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendPersonMessage: String @deprecated\n\t}\n\n\tenum SignUpErrorCode {\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t\tTOO_WEAK\n\t}\n\n\ttype SignUpResult {\n\t\tperson: Person!\n\t}\n\n\t# === signInCommon ==\n\n\tinterface CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signIn ===\n\ttype SignInResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInError!]! @deprecated\n\t\terror: SignInError\n\t\tresult: SignInResult\n\t}\n\n\ttype SignInError {\n\t\tcode: SignInErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tINVALID_PASSWORD\n\t\tPERSON_DISABLED\n\t\tNO_PASSWORD_SET\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\n\ttype SignInResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# == createSessionToken ==\n\n\ttype CreateSessionTokenResponse {\n\t\tok: Boolean!\n\t\terror: CreateSessionTokenError\n\t\tresult: CreateSessionTokenResult\n\t}\n\n\ttype CreateSessionTokenError {\n\t\tcode: CreateSessionTokenErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateSessionTokenErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tUNKNOWN_PERSON_ID\n\t\tPERSON_DISABLED\n\t}\n\n\ttype CreateSessionTokenResult implements CommonSignInResult{\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signOut ===\n\n\ttype SignOutResponse {\n\t\tok: Boolean!\n\t\terrors: [SignOutError!]! @deprecated\n\t\terror: SignOutError\n\t}\n\n\ttype SignOutError {\n\t\tcode: SignOutErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignOutErrorCode {\n\t\tNOT_A_PERSON,\n\t\tNOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY\n\t}\n\n\t# === changeProfile ===\n\t\n\ttype ChangeProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeProfileError\n\t}\n\t\n\ttype ChangeProfileError {\n\t\tcode: ChangeProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ChangeProfileErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\n\t\n\t# === changeMyProfile ===\n\n\ttype ChangeMyProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyProfileError\n\t}\n\n\ttype ChangeMyProfileError {\n\t\tcode: ChangeMyProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyProfileErrorCode {\n\t\tNOT_A_PERSON\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\t\n\n\t# === changePassword ===\n\n\ttype ChangePasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ChangePasswordError!]! @deprecated\n\t\terror: ChangePasswordError\n\t}\n\n\ttype ChangePasswordError {\n\t\tcode: ChangePasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ChangePasswordErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tTOO_WEAK\n\t}\n\n\n\t# === changeMyPassword ===\n\t\n\ttype ChangeMyPasswordResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyPasswordError\n\t}\n\n\ttype ChangeMyPasswordError {\n\t\tcode: ChangeMyPasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyPasswordErrorCode {\n\t\tTOO_WEAK\n\t\tNOT_A_PERSON\n\t\tINVALID_PASSWORD\n\t\tNO_PASSWORD_SET\n\t}\n\n\t# === IDP ===\n\n\ttype InitSignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [InitSignInIDPError!]! @deprecated\n\t\terror: InitSignInIDPError\n\t\tresult: InitSignInIDPResult\n\t}\n\n\ttype InitSignInIDPResult {\n\t\tauthUrl: String!\n\t\tsessionData: Json!\n\t\tidpConfiguration: Json\n\t}\n\n\ttype InitSignInIDPError {\n\t\tcode: InitSignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InitSignInIDPErrorCode {\n\t\tPROVIDER_NOT_FOUND\n\t\tIDP_VALIDATION_FAILED\n\t}\n\n\tinput IDPResponseInput {\n\t\turl: String!\n\t}\n\n\ttype SignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInIDPError!]! @deprecated\n\t\terror: SignInIDPError\n\t\tresult: SignInIDPResult\n\t}\n\n\ttype SignInIDPError {\n\t\tcode: SignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInIDPErrorCode {\n\t\tINVALID_IDP_RESPONSE\n\t\tIDP_VALIDATION_FAILED\n\n\t\tPERSON_NOT_FOUND\n\t\tPERSON_DISABLED\n\t\tPERSON_ALREADY_EXISTS\n\t}\n\n\ttype SignInIDPResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\tidpResponse: Json\n\t}\n\n\ttype AddIDPResponse {\n\t\terror: AddIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype AddIDPError {\n\t\tcode: AddIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddIDPErrorCode {\n\t\tALREADY_EXISTS\n\t\tUNKNOWN_TYPE\n\t\tINVALID_CONFIGURATION\n\t}\n\n\ttype UpdateIDPResponse {\n\t\terror: UpdateIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype UpdateIDPError {\n\t\tcode: UpdateIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateIDPErrorCode {\n\t\tNOT_FOUND\n\t\tINVALID_CONFIGURATION\n\t}\n\n\n\ttype DisableIDPResponse {\n\t\terror: DisableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisableIDPError {\n\t\tcode: DisableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype EnableIDPResponse {\n\t\terror: EnableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype EnableIDPError {\n\t\tcode: EnableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype IdentityProvider {\n\t\tslug: String!\n\t\ttype: String!\n\t\tconfiguration: Json!\n\t\tdisabledAt: DateTime\n\t\toptions: IDPOptionsOutput!\n\t}\n\n\ttype IDPOptionsOutput {\n\t\tautoSignUp: Boolean!\n\t\texclusive: Boolean!\n\t\tinitReturnsConfig: Boolean!\n\t}\n\n\tinput IDPOptions {\n\t\tautoSignUp: Boolean\n\t\texclusive: Boolean\n\t\tinitReturnsConfig: Boolean\n\t}\n\n\t# === passwordless sign in ===\n\t\n\ttype InitSignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: InitSignInPasswordlessError\n\t\tresult: InitSignInPasswordlessResult\n\t}\n\t\n\ttype InitSignInPasswordlessError {\n\t\tcode: InitSignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum InitSignInPasswordlessErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\t\n\t\tPASSWORDLESS_DISABLED\n\t}\n\t\n\ttype InitSignInPasswordlessResult {\n\t\trequestId: String!\n\t\texpiresAt: DateTime!\n\t}\n\n\tinput InitSignInPasswordlessOptions {\n\t\tmailVariant: String\n\t\tmailProject: String\n\t}\n\t\n\ttype SignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: SignInPasswordlessError\n\t\tresult: SignInPasswordlessResult\n\t}\n\t\n\tenum PasswordlessValidationType {\n\t\totp\n\t\ttoken\n\t}\n\t\n\ttype SignInPasswordlessError {\n\t\tcode: SignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum SignInPasswordlessErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t\tPERSON_DISABLED\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\t\n\ttype SignInPasswordlessResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\t\n\ttype ActivatePasswordlessOtpResponse {\n\t\tok: Boolean!\n\t\terror: ActivatePasswordlessOtpError\n\t}\n\t\n\ttype ActivatePasswordlessOtpError {\n\t\tcode: ActivatePasswordlessOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ActivatePasswordlessOtpErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t}\n\t\n\ttype ToggleMyPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: ToggleMyPasswordlessError\n\t}\n\t\n\ttype ToggleMyPasswordlessError {\n\t\tcode: ToggleMyPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ToggleMyPasswordlessErrorCode {\n\t\tCANNOT_TOGGLE\n        NOT_A_PERSON\n\t}\n\t\n\n\t# === invite ===\n\n\ttype InviteResponse {\n\t\tok: Boolean!\n\t\terrors: [InviteError!]! @deprecated\n\t\terror: InviteError\n\t\tresult: InviteResult\n\t}\n\n\ttype InviteError {\n\t\tcode: InviteErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InviteErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\t\tINVALID_EMAIL_FORMAT\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype InviteResult {\n\t\tperson: Person!\n\t\tisNew: Boolean!\n\t}\n\n\tenum InviteMethod {\n\t\tCREATE_PASSWORD\n\t\tRESET_PASSWORD\n\t}\n\n\tinput InviteOptions {\n\t\tmethod: InviteMethod\n\t\tmailVariant: String\n\t}\n\n\tinput UnmanagedInviteOptions {\n\t\tpassword: String\n\t\tresetTokenHash: String\n\t}\n\n\t# === addProjectMember ===\n\n\ttype AddProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [AddProjectMemberError!]!\n\t\terror: AddProjectMemberError\n\t}\n\n\ttype AddProjectMemberError {\n\t\tcode: AddProjectMemberErrorCode!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tIDENTITY_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === updateProjectMember ===\n\n\ttype UpdateProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [UpdateProjectMemberError!]! @deprecated\n\t\terror: UpdateProjectMemberError\n\t}\n\n\ttype UpdateProjectMemberError {\n\t\tcode: UpdateProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum UpdateProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tNOT_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === removeProjectMember ===\n\n\ttype RemoveProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveProjectMemberError!]!\n\t\terror: RemoveProjectMemberError\n\t}\n\n\ttype RemoveProjectMemberError {\n\t\tcode: RemoveProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveProjectMemberErrorCode {\n\t\tNOT_MEMBER\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === createApiKey ===\n\n\ttype CreateApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [CreateApiKeyError!]! @deprecated\n\t\terror: CreateApiKeyError\n\t\tresult: CreateApiKeyResult\n\t}\n\n\ttype CreateApiKeyError {\n\t\tcode: CreateApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreateApiKeyErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_MEMBERSHIP\n\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype CreateApiKeyResult {\n\t\tapiKey: ApiKeyWithToken!\n\t}\n\n\t# === disableApiKey ===\n\n\ttype DisableApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableApiKeyError!]! @deprecated\n\t\terror: DisableApiKeyError\n\t}\n\n\ttype DisableApiKeyError {\n\t\tcode: DisableApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableApiKeyErrorCode {\n\t\tKEY_NOT_FOUND\n\t}\n\t# === addGlobalIdentityRoles ===\n\n\ttype AddGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: AddGlobalIdentityRolesError\n\t\tresult: AddGlobalIdentityRolesResult\n\t}\n\n\ttype AddGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\ttype AddGlobalIdentityRolesError {\n\t\tcode: AddGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\n\n\t# === removeGlobalIdentityRoles ===\n\n\ttype RemoveGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: RemoveGlobalIdentityRolesError\n\t\tresult: RemoveGlobalIdentityRolesResult\n\t}\n\n\ttype RemoveGlobalIdentityRolesError {\n\t\tcode: RemoveGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype RemoveGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\n\tenum RemoveGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\t# === common ===\n\n\t# === variables ===\n\n\tinput VariableEntryInput {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\ttype VariableEntry {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\t# === membership ===\n\n\tinput MembershipInput {\n\t\trole: String!\n\t\tvariables: [VariableEntryInput!]!\n\t}\n\n\ttype Membership {\n\t\trole: String!\n\t\tvariables: [VariableEntry!]!\n\t}\n\n\ttype MembershipValidationError {\n\t\tcode: MembershipValidationErrorCode!\n\t\trole: String!\n\t\tvariable: String\n\t}\n\n\tenum MembershipValidationErrorCode {\n\t\tROLE_NOT_FOUND\n\t\tVARIABLE_NOT_FOUND\n\t\tVARIABLE_EMPTY\n\t\tVARIABLE_INVALID\n\t}\n\n\t# === person ====\n\n\ttype Person {\n\t\tid: String!\n\t\temail: String\n\t\tname: String\n\t\totpEnabled: Boolean!\n\t\tpasswordlessEnabled: Boolean\n\t\tidentity: Identity!\n\t}\n\n\t# === api key ===\n\n\ttype ApiKey {\n\t\tid: String!\n\t\tidentity: Identity!\n\t}\n\n\ttype ApiKeyWithToken {\n\t\tid: String!\n\t\ttoken: String\n\t\tidentity: Identity!\n\t}\n\n\t# === identity ===\n\n\ttype Identity {\n\t\tid: String!\n\t\tdescription: String\n\t\tperson: Person\n\t\tapiKey: ApiKey\n\t\tprojects: [IdentityProjectRelation!]!\n\t\tpermissions: IdentityGlobalPermissions\n\t\troles: [String!]\n\t}\n\n\ttype IdentityGlobalPermissions {\n\t\tcanCreateProject: Boolean!\n\t\tcanDeployEntrypoint: Boolean!\n\t}\n\n\ttype IdentityProjectRelation {\n\t\tproject: Project!\n\t\tmemberships: [Membership!]!\n\t}\n\n\t# === project ===\n\n\ttype Project {\n\t\tid: String!\n\t\tname: String!\n\t\tslug: String!\n\t\tconfig: Json!\n\t\troles: [RoleDefinition!]!\n\t\tmembers(\n\t\t\tinput: ProjectMembersInput,\n\t\t\tmemberType: MemberType @deprecated(reason: \"Use args\")\n\t\t): [ProjectIdentityRelation!]!\n\t}\n\n\tinput ProjectMembersInput {\n\t\tlimit: Int\n\t\toffset: Int\n\t\tfilter: ProjectMembersFilter\n\t}\n\n\tinput ProjectMembersFilter {\n\t\tmemberType: MemberType\n\t\temail: [String!]\n\t\tidentityId: [String!]\n\t\tpersonId: [String!]\n\t}\n\n\tenum MemberType {\n\t\tAPI_KEY\n\t\tPERSON\n\t}\n\n\ttype ProjectIdentityRelation {\n\t\tidentity: Identity!\n\t\tmemberships: [Membership!]!\n\t}\n\n\ttype RoleDefinition {\n\t\tname: String!\n\t\tvariables: [RoleVariableDefinition!]!\n\t}\n\n\tinterface RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\ttype RoleEntityVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tentityName: String!\n\t}\n\n\ttype RolePredefinedVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tvalue: String!\n\t}\n\n\ttype RoleConditionVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\t# ==== 2fa ====\n\n\ttype PrepareOtpResponse {\n\t\tok: Boolean!\n\t\tresult: PrepareOtpResult\n\t}\n\n\ttype PrepareOtpResult {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\ttype ConfirmOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [ConfirmOtpError!]! @deprecated\n\t\terror: ConfirmOtpError\n\t}\n\n\ttype ConfirmOtpError {\n\t\tcode: ConfirmOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ConfirmOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t\tNOT_PREPARED\n\t}\n\n\ttype DisableOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableOtpError!]! @deprecated\n\t\terror: DisableOtpError\n\t}\n\n\ttype DisableOtpError {\n\t\tcode: DisableOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableOtpErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t}\n\n\ttype DisablePersonResponse {\n\t\tok: Boolean!\n\t\terror: DisablePersonError\n\t}\n\n\ttype DisablePersonError {\n\t\tcode: DisablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisablePersonErrorCode {\n\t\tPERSON_ALREADY_DISABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === mails ===\n\t\n\ttype MailTemplateData {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean!\n\t\treplyTo: String\n\t}\n\t\n\tinput MailTemplate {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\t\"Custom mail variant identifier, e.g. a locale.\"\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean\n\t\treplyTo: String\n\t}\n\n\tenum MailType {\n\t\tEXISTING_USER_INVITED\n\t\tNEW_USER_INVITED\n\t\tRESET_PASSWORD_REQUEST\n\t\tPASSWORDLESS_SIGN_IN\n\t}\n\n\tinput MailTemplateIdentifier {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t}\n\n\ttype AddMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [AddMailTemplateError!]! @deprecated\n\t\terror: AddMailTemplateError\n\t}\n\n\ttype AddMailTemplateError {\n\t\tcode: AddMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddMailTemplateErrorCode {\n\t\tMISSING_VARIABLE\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_REPLY_EMAIL_FORMAT\n\t}\n\n\ttype RemoveMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveMailTemplateError!]!\n\t\terror: RemoveMailTemplateError\n\t}\n\n\ttype RemoveMailTemplateError {\n\t\tcode: RemoveMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveMailTemplateErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tTEMPLATE_NOT_FOUND\n\t}\n\n\t# === password reset ===\n\n\ttype CheckResetPasswordTokenResult {\n\t\tcode: CheckResetPasswordTokenCode!\n\t}\n\n\tenum CheckResetPasswordTokenCode {\n\t\tREQUEST_NOT_FOUND\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype CreatePasswordResetRequestResponse {\n\t\tok: Boolean!\n\t\terrors: [CreatePasswordResetRequestError!]! @deprecated\n\t\terror: CreatePasswordResetRequestError\n\t}\n\n\ttype CreatePasswordResetRequestError {\n\t\tcode: CreatePasswordResetRequestErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreatePasswordResetRequestErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\ttype ResetPasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ResetPasswordError!]! @deprecated\n\t\terror: ResetPasswordError\n\t}\n\ttype ResetPasswordError {\n\t\tcode: ResetPasswordErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ResetPasswordErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\n\t\tPASSWORD_TOO_WEAK\n\t}\n\n\tinput CreateResetPasswordRequestOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\t# === project ===\n\n\tinput ProjectSecret {\n\t\tkey: String!\n\t\tvalue: String!\n\t}\n\n\tinput CreateProjectOptions {\n\t\tdeployTokenHash: String\n\t\tnoDeployToken: Boolean\n\t}\n\n\ttype CreateProjectResponse {\n\t\tok: Boolean!\n\t\terror: CreateProjectResponseError\n\t\tresult: CreateProjectResult\n\t}\n\n\ttype CreateProjectResponseError {\n\t\tcode: CreateProjectResponseErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype CreateProjectResult {\n\t\tdeployerApiKey: ApiKeyWithToken\n\t}\n\n\tenum CreateProjectResponseErrorCode {\n\t\tALREADY_EXISTS\n\t\tINIT_ERROR\n\t}\n\n\ttype SetProjectSecretResponse {\n\t\tok: Boolean!\n\t\terror: SetProjectSecretError\n\t}\n\n\ttype SetProjectSecretError {\n\t\tcode: SetProjectSecretErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum SetProjectSecretErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateProjectResponse {\n\t\tok: Boolean!\n\t\terror: UpdateProjectError\n\t}\n\n\ttype UpdateProjectError {\n\t\tcode: UpdateProjectErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateProjectErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n`\n\nexport default schema\n"],"names":["gql"],"mappings":";;AAGA,MAAM,SAAuBA,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;"}
+{"version":3,"file":"tenant.graphql.cjs","sources":["../../../../../packages/engine-tenant-api/src/schema/tenant.graphql.ts"],"sourcesContent":["import { gql } from 'graphql-tag'\nimport { DocumentNode } from 'graphql'\n\nconst schema: DocumentNode = gql`\n\tscalar Json\n\tscalar DateTime\n\t\n\t\"\"\" Interval is a string in the format ISO 8601, e.g. \"PT1H\" for 1 hour \"\"\"\n\tscalar Interval\n\n\tschema {\n\t\tquery: Query\n\t\tmutation: Mutation\n\t}\n\n\ttype Query {\n\t\tme: Identity!\n\t\tpersonById(id: String!): Person\n\t\tprojects: [Project!]!\n\t\tprojectBySlug(slug: String!): Project\n\t\tprojectMemberships(projectSlug: String!, identityId: String!): [Membership!]!\n\t\tcheckResetPasswordToken(requestId: String!, token: String!): CheckResetPasswordTokenCode!\n\n\t\tidentityProviders: [IdentityProvider!]!\n\t\tmailTemplates: [MailTemplateData!]!\n\t\t\n\t\tconfiguration: Config!\n\t}\n\n\ttype Mutation {\n\t\tsignUp(email: String!, password: String, passwordHash: String, roles: [String!], name: String): SignUpResponse\n\t\tsignIn(email: String!, password: String!, expiration: Int, otpToken: String): SignInResponse\n\t\tcreateSessionToken(email: String, personId: String, expiration: Int): CreateSessionTokenResponse\n\t\tsignOut(all: Boolean): SignOutResponse\n\t\tchangeProfile(personId: String!, email: String, name: String): ChangeProfileResponse\n\t\tchangeMyProfile(email: String, name: String): ChangeMyProfileResponse\n\t\tchangePassword(personId: String!, password: String!): ChangePasswordResponse\n\t\tchangeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse\n\n\t\tinitSignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\")\n\t\t): InitSignInIDPResponse\n\t\tsignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json,\n\t\t\texpiration: Int\n\t\t\tidpResponse: IDPResponseInput, @deprecated(reason: \"pass idpResponse.url as data.url\")\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\"),\n\t\t\tsessionData: Json @deprecated(reason: \"use data.sessionData\"),\n\t\t): SignInIDPResponse\n\t\t\n\t\t# passwordless sign in\n\t\tinitSignInPasswordless(email: String!, options: InitSignInPasswordlessOptions): InitSignInPasswordlessResponse\n\t\tsignInPasswordless(requestId: String!, validationType: PasswordlessValidationType!, token: String!, expiration: Int, mfaOtp: String): SignInPasswordlessResponse\n\t\tactivatePasswordlessOtp(requestId: String!, token: String!, otpHash: String!): ActivatePasswordlessOtpResponse\n\n        enableMyPasswordless: ToggleMyPasswordlessResponse\n        disableMyPasswordless: ToggleMyPasswordlessResponse\n\n\t\t# IDP management\n\t\taddIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse\n\t\tupdateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions, mergeConfiguration: Boolean): UpdateIDPResponse\n\t\tdisableIDP(identityProvider: String!): DisableIDPResponse\n\t\tenableIDP(identityProvider: String!): EnableIDPResponse\n\n\t\tprepareOtp(label: String): PrepareOtpResponse\n\t\tconfirmOtp(otpToken: String!): ConfirmOtpResponse\n\t\tdisableOtp: DisableOtpResponse\n\n\t\tdisablePerson(personId: String!): DisablePersonResponse\n\n\t\tcreateResetPasswordRequest(email: String!, options: CreateResetPasswordRequestOptions): CreatePasswordResetRequestResponse\n\t\tresetPassword(token: String!, password: String!): ResetPasswordResponse\n\n\t\tinvite(email: String!, name: String, projectSlug: String!, memberships: [MembershipInput!]!, options: InviteOptions): InviteResponse\n\t\tunmanagedInvite(\n\t\t\temail: String!,\n\t\t\tname: String,\n\t\t\tprojectSlug: String!,\n\t\t\tmemberships: [MembershipInput!]!,\n\t\t\toptions: UnmanagedInviteOptions,\n\t\t\tpassword: String @deprecated(reason: \"Use options\")\n\t\t): InviteResponse\n\n\t\taddProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): AddProjectMemberResponse\n\t\tremoveProjectMember(projectSlug: String!, identityId: String!): RemoveProjectMemberResponse\n\n\t\tupdateProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): UpdateProjectMemberResponse\n\n\t\tcreateApiKey(projectSlug: String!, memberships: [MembershipInput!]!, description: String!, tokenHash: String): CreateApiKeyResponse\n\t\tcreateGlobalApiKey(description: String!, roles: [String!], tokenHash: String): CreateApiKeyResponse\n\t\tdisableApiKey(id: String!): DisableApiKeyResponse\n\t\taddGlobalIdentityRoles(identityId: String!, roles: [String!]!): AddGlobalIdentityRolesResponse\n\t\tremoveGlobalIdentityRoles(identityId: String!, roles: [String!]!): RemoveGlobalIdentityRolesResponse\n\n\t\taddMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\tremoveMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\n\t\tcreateProject(\n\t\t\tprojectSlug: String!,\n\t\t\tname: String,\n\t\t\tconfig: Json,\n\t\t\tsecrets: [ProjectSecret!],\n\t\t\toptions: CreateProjectOptions,\n\t\t\tdeployTokenHash: String @deprecated(reason: \"Use options\")\n\t\t): CreateProjectResponse\n\t\tsetProjectSecret(projectSlug: String!, key: String!, value: String!): SetProjectSecretResponse\n\t\tupdateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse\n\t\t\n\t\tconfigure(config: ConfigInput!): ConfigureResponse\n\n\t\taddProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\t@deprecated(reason: \"use addMailTemplate\")\n\n\t\tremoveProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\t\t@deprecated(reason: \"use removeMailTemplate\")\n\n\t}\n\t\n\t# === configure ===\n\t\n\ttype Config {\n\t\tpasswordless: ConfigPasswordless!\n\t\tpassword: ConfigPassword!\n\t\tlogin: ConfigLogin!\n\t}\n\t\n\ttype ConfigPasswordless {\n\t\tenabled: ConfigPolicy!\n\t\turl: String\n\t\texpiration: Interval!\n\t}\n\t\n\ttype ConfigPassword {\n\t\tminLength: Int!\n\t\trequireUppercase: Int!\n\t\trequireLowercase: Int!\n\t\trequireDigit: Int!\n\t\trequireSpecial: Int!\n\t\tpattern: String\n\t\tcheckBlacklist: Boolean!\n    }\n\t\n\ttype ConfigLogin {\n\t\tbaseBackoff: Interval!\n\t\tmaxBackoff: Interval!\n\t\tattemptWindow: Interval!\n\t\trevealUserExists: Boolean!\n\t\tdefaultTokenExpiration: Interval!\n\t\tmaxTokenExpiration: Interval\n    }\n\t\n\tinput ConfigInput {\n\t\tpasswordless: ConfigPasswordlessInput\n\t\tpassword: ConfigPasswordInput\n\t\tlogin: ConfigLoginInput\n\t}\n\t\n\tenum ConfigPolicy {\n\t\talways\n\t\tnever\n\t\toptIn\n\t\toptOut\n\t}\n\t\n\tinput ConfigPasswordlessInput {\n\t\tenabled: ConfigPolicy\n\t\turl: String\n\t\texpiration: Interval\n\t}\n\t\n\tinput ConfigPasswordInput {\n\t\tminLength: Int\n\t\trequireUppercase: Int\n\t\trequireLowercase: Int\n\t\trequireDigit: Int\n\t\trequireSpecial: Int\n\t\tpattern: String\n\t\tcheckBlacklist: Boolean\n    }\n\t\n\tinput ConfigLoginInput {\n\t\tbaseBackoff: Interval\n\t\tmaxBackoff: Interval\n\t\tattemptWindow: Interval\n\t\trevealUserExists: Boolean\n\t\tdefaultTokenExpiration: Interval\n\t\tmaxTokenExpiration: Interval\n    }\n\t\n\ttype ConfigureResponse {\n\t\tok: Boolean!\n\t\terror: ConfigureError\n\t}\n\t\n\ttype ConfigureError {\n\t\tcode: ConfigureErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ConfigureErrorCode {\n\t\tINVALID_CONFIG\n\t}\n\n\t# === signUp ===\n\ttype SignUpResponse {\n\t\tok: Boolean!\n\t\terrors: [SignUpError!]! @deprecated\n\t\terror: SignUpError\n\t\tresult: SignUpResult\n\t}\n\n\ttype SignUpError {\n\t\tcode: SignUpErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendPersonMessage: String @deprecated\n\t}\n\n\tenum SignUpErrorCode {\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t\tTOO_WEAK\n\t}\n\n\ttype SignUpResult {\n\t\tperson: Person!\n\t}\n\n\t# === signInCommon ==\n\n\tinterface CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signIn ===\n\ttype SignInResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInError!]! @deprecated\n\t\terror: SignInError\n\t\tresult: SignInResult\n\t}\n\n\ttype SignInError {\n\t\tcode: SignInErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t\tretryAfter: Int\n\t}\n\n\tenum SignInErrorCode {\n\t\tINVALID_CREDENTIALS\n\t\tUNKNOWN_EMAIL\n\t\tINVALID_PASSWORD\n\t\tPERSON_DISABLED\n\t\tNO_PASSWORD_SET\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\ttype SignInResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# == createSessionToken ==\n\n\ttype CreateSessionTokenResponse {\n\t\tok: Boolean!\n\t\terror: CreateSessionTokenError\n\t\tresult: CreateSessionTokenResult\n\t}\n\n\ttype CreateSessionTokenError {\n\t\tcode: CreateSessionTokenErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateSessionTokenErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tUNKNOWN_PERSON_ID\n\t\tPERSON_DISABLED\n\t}\n\n\ttype CreateSessionTokenResult implements CommonSignInResult{\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signOut ===\n\n\ttype SignOutResponse {\n\t\tok: Boolean!\n\t\terrors: [SignOutError!]! @deprecated\n\t\terror: SignOutError\n\t}\n\n\ttype SignOutError {\n\t\tcode: SignOutErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignOutErrorCode {\n\t\tNOT_A_PERSON,\n\t\tNOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY\n\t}\n\n\t# === changeProfile ===\n\t\n\ttype ChangeProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeProfileError\n\t}\n\t\n\ttype ChangeProfileError {\n\t\tcode: ChangeProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ChangeProfileErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\n\t\n\t# === changeMyProfile ===\n\n\ttype ChangeMyProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyProfileError\n\t}\n\n\ttype ChangeMyProfileError {\n\t\tcode: ChangeMyProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyProfileErrorCode {\n\t\tNOT_A_PERSON\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\t\n\n\t# === changePassword ===\n\n\ttype ChangePasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ChangePasswordError!]! @deprecated\n\t\terror: ChangePasswordError\n\t}\n\n\ttype ChangePasswordError {\n\t\tcode: ChangePasswordErrorCode!\n\t\tweakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ChangePasswordErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tTOO_WEAK\n\t}\n\t\n\tenum WeakPasswordReason {\n\t\tTOO_SHORT\n\t\tMISSING_UPPERCASE\n\t\tMISSING_LOWERCASE\n\t\tMISSING_DIGIT\n\t\tMISSING_SPECIAL\n\t\tINVALID_PATTERN\n\t\tBLACKLISTED\n    }\n\n\n\t# === changeMyPassword ===\n\t\n\ttype ChangeMyPasswordResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyPasswordError\n\t}\n\n\ttype ChangeMyPasswordError {\n\t\tcode: ChangeMyPasswordErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyPasswordErrorCode {\n\t\tTOO_WEAK\n\t\tNOT_A_PERSON\n\t\tINVALID_PASSWORD\n\t\tNO_PASSWORD_SET\n\t}\n\n\t# === IDP ===\n\n\ttype InitSignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [InitSignInIDPError!]! @deprecated\n\t\terror: InitSignInIDPError\n\t\tresult: InitSignInIDPResult\n\t}\n\n\ttype InitSignInIDPResult {\n\t\tauthUrl: String!\n\t\tsessionData: Json!\n\t\tidpConfiguration: Json\n\t}\n\n\ttype InitSignInIDPError {\n\t\tcode: InitSignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InitSignInIDPErrorCode {\n\t\tPROVIDER_NOT_FOUND\n\t\tIDP_VALIDATION_FAILED\n\t}\n\n\tinput IDPResponseInput {\n\t\turl: String!\n\t}\n\n\ttype SignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInIDPError!]! @deprecated\n\t\terror: SignInIDPError\n\t\tresult: SignInIDPResult\n\t}\n\n\ttype SignInIDPError {\n\t\tcode: SignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInIDPErrorCode {\n\t\tINVALID_IDP_RESPONSE\n\t\tIDP_VALIDATION_FAILED\n\n\t\tPERSON_NOT_FOUND\n\t\tPERSON_DISABLED\n\t\tPERSON_ALREADY_EXISTS\n\t}\n\n\ttype SignInIDPResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\tidpResponse: Json\n\t}\n\n\ttype AddIDPResponse {\n\t\terror: AddIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype AddIDPError {\n\t\tcode: AddIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddIDPErrorCode {\n\t\tALREADY_EXISTS\n\t\tUNKNOWN_TYPE\n\t\tINVALID_CONFIGURATION\n\t}\n\n\ttype UpdateIDPResponse {\n\t\terror: UpdateIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype UpdateIDPError {\n\t\tcode: UpdateIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateIDPErrorCode {\n\t\tNOT_FOUND\n\t\tINVALID_CONFIGURATION\n\t}\n\n\n\ttype DisableIDPResponse {\n\t\terror: DisableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisableIDPError {\n\t\tcode: DisableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype EnableIDPResponse {\n\t\terror: EnableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype EnableIDPError {\n\t\tcode: EnableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype IdentityProvider {\n\t\tslug: String!\n\t\ttype: String!\n\t\tconfiguration: Json!\n\t\tdisabledAt: DateTime\n\t\toptions: IDPOptionsOutput!\n\t}\n\n\ttype IDPOptionsOutput {\n\t\tautoSignUp: Boolean!\n\t\texclusive: Boolean!\n\t\tinitReturnsConfig: Boolean!\n\t}\n\n\tinput IDPOptions {\n\t\tautoSignUp: Boolean\n\t\texclusive: Boolean\n\t\tinitReturnsConfig: Boolean\n\t}\n\n\t# === passwordless sign in ===\n\t\n\ttype InitSignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: InitSignInPasswordlessError\n\t\tresult: InitSignInPasswordlessResult\n\t}\n\t\n\ttype InitSignInPasswordlessError {\n\t\tcode: InitSignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum InitSignInPasswordlessErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\t\n\t\tPASSWORDLESS_DISABLED\n\t}\n\t\n\ttype InitSignInPasswordlessResult {\n\t\trequestId: String!\n\t\texpiresAt: DateTime!\n\t}\n\n\tinput InitSignInPasswordlessOptions {\n\t\tmailVariant: String\n\t\tmailProject: String\n\t}\n\t\n\ttype SignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: SignInPasswordlessError\n\t\tresult: SignInPasswordlessResult\n\t}\n\t\n\tenum PasswordlessValidationType {\n\t\totp\n\t\ttoken\n\t}\n\t\n\ttype SignInPasswordlessError {\n\t\tcode: SignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum SignInPasswordlessErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t\tPERSON_DISABLED\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t}\n\t\n\ttype SignInPasswordlessResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\t\n\ttype ActivatePasswordlessOtpResponse {\n\t\tok: Boolean!\n\t\terror: ActivatePasswordlessOtpError\n\t}\n\t\n\ttype ActivatePasswordlessOtpError {\n\t\tcode: ActivatePasswordlessOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ActivatePasswordlessOtpErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t}\n\t\n\ttype ToggleMyPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: ToggleMyPasswordlessError\n\t}\n\t\n\ttype ToggleMyPasswordlessError {\n\t\tcode: ToggleMyPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ToggleMyPasswordlessErrorCode {\n\t\tCANNOT_TOGGLE\n        NOT_A_PERSON\n\t}\n\t\n\n\t# === invite ===\n\n\ttype InviteResponse {\n\t\tok: Boolean!\n\t\terrors: [InviteError!]! @deprecated\n\t\terror: InviteError\n\t\tresult: InviteResult\n\t}\n\n\ttype InviteError {\n\t\tcode: InviteErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InviteErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\t\tINVALID_EMAIL_FORMAT\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype InviteResult {\n\t\tperson: Person!\n\t\tisNew: Boolean!\n\t}\n\n\tenum InviteMethod {\n\t\tCREATE_PASSWORD\n\t\tRESET_PASSWORD\n\t}\n\n\tinput InviteOptions {\n\t\tmethod: InviteMethod\n\t\tmailVariant: String\n\t}\n\n\tinput UnmanagedInviteOptions {\n\t\tpassword: String\n\t\tresetTokenHash: String\n\t}\n\n\t# === addProjectMember ===\n\n\ttype AddProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [AddProjectMemberError!]!\n\t\terror: AddProjectMemberError\n\t}\n\n\ttype AddProjectMemberError {\n\t\tcode: AddProjectMemberErrorCode!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tIDENTITY_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === updateProjectMember ===\n\n\ttype UpdateProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [UpdateProjectMemberError!]! @deprecated\n\t\terror: UpdateProjectMemberError\n\t}\n\n\ttype UpdateProjectMemberError {\n\t\tcode: UpdateProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum UpdateProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tNOT_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === removeProjectMember ===\n\n\ttype RemoveProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveProjectMemberError!]!\n\t\terror: RemoveProjectMemberError\n\t}\n\n\ttype RemoveProjectMemberError {\n\t\tcode: RemoveProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveProjectMemberErrorCode {\n\t\tNOT_MEMBER\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === createApiKey ===\n\n\ttype CreateApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [CreateApiKeyError!]! @deprecated\n\t\terror: CreateApiKeyError\n\t\tresult: CreateApiKeyResult\n\t}\n\n\ttype CreateApiKeyError {\n\t\tcode: CreateApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreateApiKeyErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_MEMBERSHIP\n\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype CreateApiKeyResult {\n\t\tapiKey: ApiKeyWithToken!\n\t}\n\n\t# === disableApiKey ===\n\n\ttype DisableApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableApiKeyError!]! @deprecated\n\t\terror: DisableApiKeyError\n\t}\n\n\ttype DisableApiKeyError {\n\t\tcode: DisableApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableApiKeyErrorCode {\n\t\tKEY_NOT_FOUND\n\t}\n\t# === addGlobalIdentityRoles ===\n\n\ttype AddGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: AddGlobalIdentityRolesError\n\t\tresult: AddGlobalIdentityRolesResult\n\t}\n\n\ttype AddGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\ttype AddGlobalIdentityRolesError {\n\t\tcode: AddGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\n\n\t# === removeGlobalIdentityRoles ===\n\n\ttype RemoveGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: RemoveGlobalIdentityRolesError\n\t\tresult: RemoveGlobalIdentityRolesResult\n\t}\n\n\ttype RemoveGlobalIdentityRolesError {\n\t\tcode: RemoveGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype RemoveGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\n\tenum RemoveGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\t# === common ===\n\n\t# === variables ===\n\n\tinput VariableEntryInput {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\ttype VariableEntry {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\t# === membership ===\n\n\tinput MembershipInput {\n\t\trole: String!\n\t\tvariables: [VariableEntryInput!]!\n\t}\n\n\ttype Membership {\n\t\trole: String!\n\t\tvariables: [VariableEntry!]!\n\t}\n\n\ttype MembershipValidationError {\n\t\tcode: MembershipValidationErrorCode!\n\t\trole: String!\n\t\tvariable: String\n\t}\n\n\tenum MembershipValidationErrorCode {\n\t\tROLE_NOT_FOUND\n\t\tVARIABLE_NOT_FOUND\n\t\tVARIABLE_EMPTY\n\t\tVARIABLE_INVALID\n\t}\n\n\t# === person ====\n\n\ttype Person {\n\t\tid: String!\n\t\temail: String\n\t\tname: String\n\t\totpEnabled: Boolean!\n\t\tpasswordlessEnabled: Boolean\n\t\tidentity: Identity!\n\t}\n\n\t# === api key ===\n\n\ttype ApiKey {\n\t\tid: String!\n\t\tidentity: Identity!\n\t}\n\n\ttype ApiKeyWithToken {\n\t\tid: String!\n\t\ttoken: String\n\t\tidentity: Identity!\n\t}\n\n\t# === identity ===\n\n\ttype Identity {\n\t\tid: String!\n\t\tdescription: String\n\t\tperson: Person\n\t\tapiKey: ApiKey\n\t\tprojects: [IdentityProjectRelation!]!\n\t\tpermissions: IdentityGlobalPermissions\n\t\troles: [String!]\n\t}\n\n\ttype IdentityGlobalPermissions {\n\t\tcanCreateProject: Boolean!\n\t\tcanDeployEntrypoint: Boolean!\n\t}\n\n\ttype IdentityProjectRelation {\n\t\tproject: Project!\n\t\tmemberships: [Membership!]!\n\t}\n\n\t# === project ===\n\n\ttype Project {\n\t\tid: String!\n\t\tname: String!\n\t\tslug: String!\n\t\tconfig: Json!\n\t\troles: [RoleDefinition!]!\n\t\tmembers(\n\t\t\tinput: ProjectMembersInput,\n\t\t\tmemberType: MemberType @deprecated(reason: \"Use args\")\n\t\t): [ProjectIdentityRelation!]!\n\t}\n\n\tinput ProjectMembersInput {\n\t\tlimit: Int\n\t\toffset: Int\n\t\tfilter: ProjectMembersFilter\n\t}\n\n\tinput ProjectMembersFilter {\n\t\tmemberType: MemberType\n\t\temail: [String!]\n\t\tidentityId: [String!]\n\t\tpersonId: [String!]\n\t}\n\n\tenum MemberType {\n\t\tAPI_KEY\n\t\tPERSON\n\t}\n\n\ttype ProjectIdentityRelation {\n\t\tidentity: Identity!\n\t\tmemberships: [Membership!]!\n\t}\n\n\ttype RoleDefinition {\n\t\tname: String!\n\t\tvariables: [RoleVariableDefinition!]!\n\t}\n\n\tinterface RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\ttype RoleEntityVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tentityName: String!\n\t}\n\n\ttype RolePredefinedVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tvalue: String!\n\t}\n\n\ttype RoleConditionVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\t# ==== 2fa ====\n\n\ttype PrepareOtpResponse {\n\t\tok: Boolean!\n\t\tresult: PrepareOtpResult\n\t}\n\n\ttype PrepareOtpResult {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\ttype ConfirmOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [ConfirmOtpError!]! @deprecated\n\t\terror: ConfirmOtpError\n\t}\n\n\ttype ConfirmOtpError {\n\t\tcode: ConfirmOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ConfirmOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t\tNOT_PREPARED\n\t}\n\n\ttype DisableOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableOtpError!]! @deprecated\n\t\terror: DisableOtpError\n\t}\n\n\ttype DisableOtpError {\n\t\tcode: DisableOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableOtpErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t}\n\n\ttype DisablePersonResponse {\n\t\tok: Boolean!\n\t\terror: DisablePersonError\n\t}\n\n\ttype DisablePersonError {\n\t\tcode: DisablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisablePersonErrorCode {\n\t\tPERSON_ALREADY_DISABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === mails ===\n\t\n\ttype MailTemplateData {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean!\n\t\treplyTo: String\n\t}\n\t\n\tinput MailTemplate {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\t\"Custom mail variant identifier, e.g. a locale.\"\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean\n\t\treplyTo: String\n\t}\n\n\tenum MailType {\n\t\tEXISTING_USER_INVITED\n\t\tNEW_USER_INVITED\n\t\tRESET_PASSWORD_REQUEST\n\t\tPASSWORDLESS_SIGN_IN\n\t}\n\n\tinput MailTemplateIdentifier {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t}\n\n\ttype AddMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [AddMailTemplateError!]! @deprecated\n\t\terror: AddMailTemplateError\n\t}\n\n\ttype AddMailTemplateError {\n\t\tcode: AddMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddMailTemplateErrorCode {\n\t\tMISSING_VARIABLE\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_REPLY_EMAIL_FORMAT\n\t}\n\n\ttype RemoveMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveMailTemplateError!]!\n\t\terror: RemoveMailTemplateError\n\t}\n\n\ttype RemoveMailTemplateError {\n\t\tcode: RemoveMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveMailTemplateErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tTEMPLATE_NOT_FOUND\n\t}\n\n\t# === password reset ===\n\n\ttype CheckResetPasswordTokenResult {\n\t\tcode: CheckResetPasswordTokenCode!\n\t}\n\n\tenum CheckResetPasswordTokenCode {\n\t\tREQUEST_NOT_FOUND\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype CreatePasswordResetRequestResponse {\n\t\tok: Boolean!\n\t\terrors: [CreatePasswordResetRequestError!]! @deprecated\n\t\terror: CreatePasswordResetRequestError\n\t}\n\n\ttype CreatePasswordResetRequestError {\n\t\tcode: CreatePasswordResetRequestErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreatePasswordResetRequestErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\ttype ResetPasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ResetPasswordError!]! @deprecated\n\t\terror: ResetPasswordError\n\t}\n\ttype ResetPasswordError {\n\t\tcode: ResetPasswordErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ResetPasswordErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\n\t\tPASSWORD_TOO_WEAK\n\t}\n\n\tinput CreateResetPasswordRequestOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\t# === project ===\n\n\tinput ProjectSecret {\n\t\tkey: String!\n\t\tvalue: String!\n\t}\n\n\tinput CreateProjectOptions {\n\t\tdeployTokenHash: String\n\t\tnoDeployToken: Boolean\n\t}\n\n\ttype CreateProjectResponse {\n\t\tok: Boolean!\n\t\terror: CreateProjectResponseError\n\t\tresult: CreateProjectResult\n\t}\n\n\ttype CreateProjectResponseError {\n\t\tcode: CreateProjectResponseErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype CreateProjectResult {\n\t\tdeployerApiKey: ApiKeyWithToken\n\t}\n\n\tenum CreateProjectResponseErrorCode {\n\t\tALREADY_EXISTS\n\t\tINIT_ERROR\n\t}\n\n\ttype SetProjectSecretResponse {\n\t\tok: Boolean!\n\t\terror: SetProjectSecretError\n\t}\n\n\ttype SetProjectSecretError {\n\t\tcode: SetProjectSecretErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum SetProjectSecretErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateProjectResponse {\n\t\tok: Boolean!\n\t\terror: UpdateProjectError\n\t}\n\n\ttype UpdateProjectError {\n\t\tcode: UpdateProjectErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateProjectErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n`\n\nexport default schema\n"],"names":["gql"],"mappings":";;AAGA,MAAM,SAAuBA,WAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;;"}