@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.2

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs

@@ -9,6 +9,7 @@ require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
 const exceptions = require("../../../exceptions.cjs");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
@@ -17,6 +18,7 @@ require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
@@ -27,6 +29,13 @@ class OtpMutationResolver {
   async prepareOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
     const otp = await this.otpManager.prepareOtp(context.db, person, args.label || "Contember");
+    if (person.otp_activated_at) {
+      await context.logAuthAction({
+        type: "2fa_disable",
+        response: new Response.ResponseOk(null),
+        personId: person.id
+      });
+    }
     return {
       ok: true,
       result: {
@@ -44,9 +53,20 @@ class OtpMutationResolver {
       );
     }
     if (!this.otpManager.verifyOtp(person, args.otpToken)) {
-      return errorUtils.createErrorResponse("INVALID_OTP_TOKEN", "Provided token is not correct.");
+      const responseError = new Response.ResponseError("INVALID_OTP_TOKEN", "Provided token is not correct.");
+      await context.logAuthAction({
+        type: "2fa_enable",
+        response: responseError,
+        personId: person.id
+      });
+      return errorUtils.createErrorResponse(responseError);
     }
     await this.otpManager.confirmOtp(context.db, person);
+    await context.logAuthAction({
+      type: "2fa_enable",
+      response: new Response.ResponseOk(null),
+      personId: person.id
+    });
     return {
       ok: true,
       errors: []
@@ -58,6 +78,11 @@ class OtpMutationResolver {
       return errorUtils.createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot disable it.");
     }
     await this.otpManager.disableOtp(context.db, person);
+    await context.logAuthAction({
+      type: "2fa_disable",
+      response: new Response.ResponseOk(null),
+      personId: person.id
+    });
     return {
       ok: true,
       errors: []

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AACnF,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAA,WAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AAC/C,aAAAA,WAAA,oBAAoB,qBAAqB,gCAAgC;AAAA,IAAA;AAEjF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAAA,WAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAIC,mCAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;;"}
+{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\tif (person.otp_activated_at) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_disable',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["ResponseOk","createErrorResponse","ResponseError","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAyB;AAAA,EAEtD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,QAAI,OAAO,kBAAkB;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAOC,WAAAA;AAAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AACtD,YAAM,gBAAgB,IAAIC,uBAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAOD,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAID,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAOC,WAAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAID,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js

@@ -7,6 +7,7 @@ import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
 import { ImplementationException } from "../../../exceptions.js";
+import { ResponseOk, ResponseError } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
@@ -15,6 +16,7 @@ import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
@@ -25,6 +27,13 @@ class OtpMutationResolver {
   async prepareOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
     const otp = await this.otpManager.prepareOtp(context.db, person, args.label || "Contember");
+    if (person.otp_activated_at) {
+      await context.logAuthAction({
+        type: "2fa_disable",
+        response: new ResponseOk(null),
+        personId: person.id
+      });
+    }
     return {
       ok: true,
       result: {
@@ -42,9 +51,20 @@ class OtpMutationResolver {
       );
     }
     if (!this.otpManager.verifyOtp(person, args.otpToken)) {
-      return createErrorResponse("INVALID_OTP_TOKEN", "Provided token is not correct.");
+      const responseError = new ResponseError("INVALID_OTP_TOKEN", "Provided token is not correct.");
+      await context.logAuthAction({
+        type: "2fa_enable",
+        response: responseError,
+        personId: person.id
+      });
+      return createErrorResponse(responseError);
     }
     await this.otpManager.confirmOtp(context.db, person);
+    await context.logAuthAction({
+      type: "2fa_enable",
+      response: new ResponseOk(null),
+      personId: person.id
+    });
     return {
       ok: true,
       errors: []
@@ -56,6 +76,11 @@ class OtpMutationResolver {
       return createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot disable it.");
     }
     await this.otpManager.disableOtp(context.db, person);
+    await context.logAuthAction({
+      type: "2fa_disable",
+      response: new ResponseOk(null),
+      personId: person.id
+    });
     return {
       ok: true,
       errors: []

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAChD,UAAA,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AACnF,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAEjB;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA;AAAA,QACN;AAAA,QACA;AAAA,MACD;AAAA,IAAA;AAED,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AAC/C,aAAA,oBAAoB,qBAAqB,gCAAgC;AAAA,IAAA;AAEjF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAClD,QAAA,CAAC,OAAO,SAAS;AACb,aAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IAAA;AAEzF,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AAC5C,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IACT;AAAA,EAAA;AAAA,EAGD,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,wBAAwB,sBAAsB;AAAA,IAAA;AAGlD,WAAA;AAAA,EAAA;AAET;"}
+{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\tif (person.otp_activated_at) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_disable',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAyB;AAAA,EAEtD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,QAAI,OAAO,kBAAkB;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AACtD,YAAM,gBAAgB,IAAI,cAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAO,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs

@@ -9,12 +9,14 @@ require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
@@ -35,7 +37,17 @@ class PasswordlessMutationResolver {
       mailVariant: args.options?.mailVariant ?? void 0,
       mailProject: args.options?.mailProject ?? void 0
     });
+    await context.logAuthAction({
+      type: "passwordless_login_init",
+      response: result
+    });
     if (!result.ok) {
+      if (result.error === "PERSON_NOT_FOUND") {
+        const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+        if (!configuration.login.revealUserExists) {
+          return errorUtils.createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+        }
+      }
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
     return { ok: true, result: result.result };
@@ -53,6 +65,10 @@ class PasswordlessMutationResolver {
       validationType: args.validationType,
       expiration: args.expiration ?? void 0
     });
+    await context.logAuthAction({
+      type: "passwordless_login",
+      response: signIn
+    });
     if (!signIn.ok) {
       return errorUtils.createErrorResponse(signIn.error, signIn.errorMessage);
     }
@@ -72,6 +88,10 @@ class PasswordlessMutationResolver {
       token: args.token,
       otpHash: args.otpHash
     });
+    await context.logAuthAction({
+      type: "passwordless_login_exchange",
+      response: result
+    });
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;AAcO,MAAM,6BAA6I;AAAA,EACzJ,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAE7D,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAG1C,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAC/E;AAAA,EAAA;AAAA,EAGD,MAAM,wBAAwB,QAAa,MAA2C,SAA0E;AAC/J,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAOC,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAEpB;;"}
+{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND') {\n\t\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,oBAAoB;AACxC,cAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,YAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,iBAAOC,WAAAA,oBAAoB,yBAAyB,kDAAkD;AAAA,QACvG;AAAA,MACD;AAEA,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js

@@ -7,12 +7,14 @@ import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
@@ -33,7 +35,17 @@ class PasswordlessMutationResolver {
       mailVariant: args.options?.mailVariant ?? void 0,
       mailProject: args.options?.mailProject ?? void 0
     });
+    await context.logAuthAction({
+      type: "passwordless_login_init",
+      response: result
+    });
     if (!result.ok) {
+      if (result.error === "PERSON_NOT_FOUND") {
+        const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
+        if (!configuration.login.revealUserExists) {
+          return createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+        }
+      }
       return createErrorResponse(result.error, result.errorMessage);
     }
     return { ok: true, result: result.result };
@@ -51,6 +63,10 @@ class PasswordlessMutationResolver {
       validationType: args.validationType,
       expiration: args.expiration ?? void 0
     });
+    await context.logAuthAction({
+      type: "passwordless_login",
+      response: signIn
+    });
     if (!signIn.ok) {
       return createErrorResponse(signIn.error, signIn.errorMessage);
     }
@@ -70,6 +86,10 @@ class PasswordlessMutationResolver {
       token: args.token,
       otpHash: args.otpHash
     });
+    await context.logAuthAction({
+      type: "passwordless_login_exchange",
+      response: result
+    });
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,6BAA6I;AAAA,EACzJ,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAE7D,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO;AAAA,EAAA;AAAA,EAG1C,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAC/E;AAAA,EAAA;AAAA,EAGD,MAAM,wBAAwB,QAAa,MAA2C,SAA0E;AAC/J,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACG,QAAA,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAAA;AAEtD,WAAA,EAAE,IAAI,KAAK;AAAA,EAAA;AAEpB;"}
+{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND') {\n\t\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,oBAAoB;AACxC,cAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,YAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,iBAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,QACvG;AAAA,MACD;AAEA,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs

@@ -8,7 +8,9 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
@@ -16,6 +18,7 @@ require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
@@ -31,7 +34,17 @@ class ResetPasswordMutationResolver {
     });
     const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(args.email));
     if (!person) {
-      return errorUtils.createErrorResponse("PERSON_NOT_FOUND", "Person was not found.");
+      const responseError = new Response.ResponseError("PERSON_NOT_FOUND", `Person with email ${args.email} was not found.`);
+      await context.logAuthAction({
+        type: "password_reset_init",
+        response: responseError,
+        personInput: args.email
+      });
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      if (!configuration.login.revealUserExists) {
+        return { ok: true, errors: [] };
+      }
+      return errorUtils.createErrorResponse(responseError);
     }
     const permissionContext = await this.permissionContextFactory.create(context.db, {
       id: person.identity_id,
@@ -41,6 +54,12 @@ class ResetPasswordMutationResolver {
       mailVariant: args.options?.mailVariant || void 0,
       project: args.options?.mailProject || void 0
     });
+    await context.logAuthAction({
+      type: "password_reset_init",
+      response: new Response.ResponseOk(null),
+      personInput: args.email,
+      personId: person.id
+    });
     return { ok: true, errors: [] };
   }
   async resetPassword(parent, args, context, info) {
@@ -49,10 +68,14 @@ class ResetPasswordMutationResolver {
       message: "You are not allowed to perform reset password reset"
     });
     const result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password);
+    await context.logAuthAction({
+      type: "password_reset",
+      response: result
+    });
     if (result.ok) {
       return { ok: true, errors: [] };
     }
-    return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    return errorUtils.createErrorResponse(result);
   }
 }
 exports.ResetPasswordMutationResolver = ResetPasswordMutationResolver;

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAAC,WAAA,oBAAoB,oBAAoB,uBAAuB;AAAA,IAAA;AAGvE,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAAA,EAG/B,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAkB,kBAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,IAAA;AAE/B,WAAOE,WAAoB,oBAAA,OAAO,OAAO,OAAO,YAAY;AAAA,EAAA;AAE9D;;"}
+{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","ResponseError","ConfigurationQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAIC,SAAAA,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAOC,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAOI,WAAAA,oBAAoB,MAAM;AAAA,EAClC;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js

@@ -6,7 +6,9 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/providers/AppleProvider.js";
@@ -14,6 +16,7 @@ import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
 import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
@@ -29,7 +32,17 @@ class ResetPasswordMutationResolver {
     });
     const person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email));
     if (!person) {
-      return createErrorResponse("PERSON_NOT_FOUND", "Person was not found.");
+      const responseError = new ResponseError("PERSON_NOT_FOUND", `Person with email ${args.email} was not found.`);
+      await context.logAuthAction({
+        type: "password_reset_init",
+        response: responseError,
+        personInput: args.email
+      });
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
+      if (!configuration.login.revealUserExists) {
+        return { ok: true, errors: [] };
+      }
+      return createErrorResponse(responseError);
     }
     const permissionContext = await this.permissionContextFactory.create(context.db, {
       id: person.identity_id,
@@ -39,6 +52,12 @@ class ResetPasswordMutationResolver {
       mailVariant: args.options?.mailVariant || void 0,
       project: args.options?.mailProject || void 0
     });
+    await context.logAuthAction({
+      type: "password_reset_init",
+      response: new ResponseOk(null),
+      personInput: args.email,
+      personId: person.id
+    });
     return { ok: true, errors: [] };
   }
   async resetPassword(parent, args, context, info) {
@@ -47,10 +66,14 @@ class ResetPasswordMutationResolver {
       message: "You are not allowed to perform reset password reset"
     });
     const result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password);
+    await context.logAuthAction({
+      type: "password_reset",
+      response: result
+    });
     if (result.ok) {
       return { ok: true, errors: [] };
     }
-    return createErrorResponse(result.error, result.errorMessage);
+    return createErrorResponse(result);
   }
 }
 export {

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAYO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACK,UAAA,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACL,aAAA,oBAAoB,oBAAoB,uBAAuB;AAAA,IAAA;AAGvE,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,EAAA;AAAA,EAG/B,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAEK,UAAA,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAG;AAAA,IAAA;AAE/B,WAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,EAAA;AAE9D;"}
+{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs

@@ -8,17 +8,21 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");
+const NextLoginAttemptQuery = require("../../../model/queries/authLog/NextLoginAttemptQuery.cjs");
 class SignInMutationResolver {
   constructor(signInManager, signInResponseFactory) {
     this.signInManager = signInManager;
@@ -29,6 +33,14 @@ class SignInMutationResolver {
       action: PermissionActions.PermissionActions.PERSON_SIGN_IN,
       message: "You are not allowed to sign in"
     });
+    const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery.NextLoginAttemptQuery(args.email));
+    if (nextAllowedSignIn > /* @__PURE__ */ new Date()) {
+      return errorUtils.createErrorResponse(
+        new Response.ResponseError("RATE_LIMIT_EXCEEDED", `Too many attempts, please try again later.`, {
+          retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1e3)
+        })
+      );
+    }
     const response = await this.signInManager.signIn(
       context.db,
       args.email,
@@ -36,7 +48,15 @@ class SignInMutationResolver {
       args.expiration || void 0,
       args.otpToken || void 0
     );
+    await context.logAuthAction({
+      type: "login",
+      response
+    });
     if (!response.ok) {
+      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      if (!configuration.login.revealUserExists && ["NO_PASSWORD_SET", "NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error)) {
+        return errorUtils.createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
+      }
       return errorUtils.createErrorResponse(response.error, response.errorMessage);
     }
     return {
@@ -67,6 +87,10 @@ class SignInMutationResolver {
         message: "You are not allowed to create a session key for this person."
       })
     );
+    await context.logAuthAction({
+      type: "create_session_token",
+      response
+    });
     if (!response.ok) {
       return errorUtils.createErrorResponse(response.error, response.errorMessage);
     }