@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js

@@ -0,0 +1,112 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/PermissionsFactory.js";
+import "@contember/schema";
+import "../../../model/type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "@contember/schema-utils";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class AuthPolicyMutationResolver {
+  constructor(authPolicyManager) {
+    this.authPolicyManager = authPolicyManager;
+  }
+  async createAuthPolicy(parent, { policy }, context) {
+    await context.requireAccess({
+      action: PermissionActions.CONFIGURE,
+      message: "You are not allowed to manage auth policies"
+    });
+    const result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy));
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    await context.logAuthAction({
+      type: "auth_policy_change",
+      response: new ResponseOk(null),
+      eventData: {
+        operation: "create",
+        id: result.result.id,
+        policy: snapshotInput(policy)
+      }
+    });
+    return { ok: true, result: { id: result.result.id } };
+  }
+  async updateAuthPolicy(parent, { id, policy }, context) {
+    await context.requireAccess({
+      action: PermissionActions.CONFIGURE,
+      message: "You are not allowed to manage auth policies"
+    });
+    const result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy));
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    await context.logAuthAction({
+      type: "auth_policy_change",
+      response: new ResponseOk(null),
+      eventData: {
+        operation: "update",
+        id,
+        policy: snapshotInput(policy)
+      }
+    });
+    return { ok: true };
+  }
+  async deleteAuthPolicy(parent, { id }, context) {
+    await context.requireAccess({
+      action: PermissionActions.CONFIGURE,
+      message: "You are not allowed to manage auth policies"
+    });
+    const result = await this.authPolicyManager.deletePolicy(context.db, id);
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    await context.logAuthAction({
+      type: "auth_policy_change",
+      response: new ResponseOk(null),
+      eventData: {
+        operation: "delete",
+        id
+      }
+    });
+    return { ok: true };
+  }
+  mapInput(policy) {
+    return {
+      scope: policy.scope,
+      project: policy.project ?? null,
+      roles: [...policy.roles],
+      mfaRequired: policy.mfaRequired ?? null,
+      tokenExpiration: policy.tokenExpiration ?? null,
+      idleTimeout: policy.idleTimeout ?? null,
+      graceDuration: policy.mfaGraceDuration ?? null,
+      rememberMeAllowed: policy.rememberMeAllowed ?? null
+    };
+  }
+}
+const snapshotInput = (policy) => ({
+  scope: policy.scope,
+  project: policy.project ?? null,
+  roles: [...policy.roles],
+  mfaRequired: policy.mfaRequired ?? null,
+  tokenExpiration: policy.tokenExpiration ?? null,
+  idleTimeout: policy.idleTimeout ?? null,
+  mfaGraceDuration: policy.mfaGraceDuration ?? null,
+  rememberMeAllowed: policy.rememberMeAllowed ?? null
+});
+export {
+  AuthPolicyMutationResolver
+};
+//# sourceMappingURL=AuthPolicyMutationResolver.js.map

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs

@@ -8,12 +8,15 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -32,10 +35,27 @@ class ConfigurationMutationResolver {
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
+    await context.logAuthAction({
+      type: "tenant_config_change",
+      response: new Response.ResponseOk(null),
+      eventData: {
+        input: redactConfigInput(config)
+      }
+    });
     return {
       ok: true
     };
   }
 }
+const redactConfigInput = (input) => {
+  const out = { ...input };
+  if (input.captcha) {
+    out.captcha = {
+      ...input.captcha,
+      secret: input.captcha.secret !== null && input.captcha.secret !== void 0 && input.captcha.secret !== "" ? "***" : input.captcha.secret ?? null
+    };
+  }
+  return out;
+};
 exports.ConfigurationMutationResolver = ConfigurationMutationResolver;
 //# sourceMappingURL=ConfigurationMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}
+{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js

@@ -6,12 +6,15 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -30,11 +33,28 @@ class ConfigurationMutationResolver {
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
+    await context.logAuthAction({
+      type: "tenant_config_change",
+      response: new ResponseOk(null),
+      eventData: {
+        input: redactConfigInput(config)
+      }
+    });
     return {
       ok: true
     };
   }
 }
+const redactConfigInput = (input) => {
+  const out = { ...input };
+  if (input.captcha) {
+    out.captcha = {
+      ...input.captcha,
+      secret: input.captcha.secret !== null && input.captcha.secret !== void 0 && input.captcha.secret !== "" ? "***" : input.captcha.secret ?? null
+    };
+  }
+  return out;
+};
 export {
   ConfigurationMutationResolver
 };

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}
+{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs

@@ -8,12 +8,17 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const PersonByIdentityBatchQuery = require("../../../model/queries/person/PersonByIdentityBatchQuery.cjs");
+const IdentityQuery = require("../../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -28,14 +33,16 @@ class IdentityGlobalRolesMutationResolver {
       action: PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),
       message: "You are not allowed to add global roles"
     });
+    const [before] = await context.db.queryHandler.fetch(new IdentityQuery.IdentityQuery([identityId]));
     const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
+    await this.logRolesChange(context, identityId, "global_role_grant", before?.roles ?? []);
     return {
       ok: true,
       result: {
-        identity: { id: identityId, projects: [] }
+        identity: { id: identityId, projects: [], sessions: [] }
       }
     };
   }
@@ -44,17 +51,32 @@ class IdentityGlobalRolesMutationResolver {
       action: PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),
       message: "You are not allowed to remove global roles"
     });
+    const [before] = await context.db.queryHandler.fetch(new IdentityQuery.IdentityQuery([identityId]));
     const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
+    await this.logRolesChange(context, identityId, "global_role_revoke", before?.roles ?? []);
     return {
       ok: true,
       result: {
-        identity: { id: identityId, projects: [] }
+        identity: { id: identityId, projects: [], sessions: [] }
       }
     };
   }
+  async logRolesChange(context, identityId, auditType, beforeRoles) {
+    const [after] = await context.db.queryHandler.fetch(new IdentityQuery.IdentityQuery([identityId]));
+    const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery.PersonByIdentityBatchQuery([identityId]));
+    await context.logAuthAction({
+      type: auditType,
+      response: new Response.ResponseOk(null),
+      targetPersonId: targetPerson?.id,
+      eventData: {
+        before: { roles: beforeRoles },
+        after: { roles: after?.roles ?? [] }
+      }
+    });
+  }
 }
 exports.IdentityGlobalRolesMutationResolver = IdentityGlobalRolesMutationResolver;
 //# sourceMappingURL=GlobalRolesMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { RolesManager } from '../../../model'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [] },\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IAC1C;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IAC1C;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js

@@ -6,12 +6,17 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { PersonByIdentityBatchQuery } from "../../../model/queries/person/PersonByIdentityBatchQuery.js";
+import { IdentityQuery } from "../../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -26,14 +31,16 @@ class IdentityGlobalRolesMutationResolver {
       action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),
       message: "You are not allowed to add global roles"
     });
+    const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]));
     const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
+    await this.logRolesChange(context, identityId, "global_role_grant", before?.roles ?? []);
     return {
       ok: true,
       result: {
-        identity: { id: identityId, projects: [] }
+        identity: { id: identityId, projects: [], sessions: [] }
       }
     };
   }
@@ -42,17 +49,32 @@ class IdentityGlobalRolesMutationResolver {
       action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),
       message: "You are not allowed to remove global roles"
     });
+    const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]));
     const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
+    await this.logRolesChange(context, identityId, "global_role_revoke", before?.roles ?? []);
     return {
       ok: true,
       result: {
-        identity: { id: identityId, projects: [] }
+        identity: { id: identityId, projects: [], sessions: [] }
       }
     };
   }
+  async logRolesChange(context, identityId, auditType, beforeRoles) {
+    const [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]));
+    const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]));
+    await context.logAuthAction({
+      type: auditType,
+      response: new ResponseOk(null),
+      targetPersonId: targetPerson?.id,
+      eventData: {
+        before: { roles: beforeRoles },
+        after: { roles: after?.roles ?? [] }
+      }
+    });
+  }
 }
 export {
   IdentityGlobalRolesMutationResolver

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { RolesManager } from '../../../model'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [] },\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAaO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IAC1C;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IAC1C;AAAA,EAEF;AACD;"}
+{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.cjs

@@ -8,17 +8,22 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
+const audit = require("./audit.cjs");
 class AddIDPMutationResolver {
   constructor(idpManager) {
     this.idpManager = idpManager;
@@ -35,12 +40,24 @@ class AddIDPMutationResolver {
       options: {
         autoSignUp: args.options?.autoSignUp ?? false,
         exclusive: args.options?.exclusive ?? false,
-        initReturnsConfig: args.options?.initReturnsConfig ?? false
+        initReturnsConfig: args.options?.initReturnsConfig ?? false,
+        requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? false
       }
     });
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
+    const after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(args.identityProvider));
+    await context.logAuthAction({
+      type: "idp_create",
+      response: new Response.ResponseOk(null),
+      eventData: {
+        slug: args.identityProvider,
+        before: null,
+        after: audit.idpRowToAuditSnapshot(after)
+      }
+    });
     return { ok: true };
   }
 }

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AddIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema'\nimport { PermissionActions } from '../../../model'\nimport { IDPManager } from '../../../model/service/idp/IDPManager'\nimport { createErrorResponse } from '../../errorUtils'\nimport { TenantResolverContext } from '../../TenantResolverContext'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,MAAA;AAAA,IACvD,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"AddIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","IdentityProviderBySlugQuery","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAOC,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.js

@@ -6,17 +6,22 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
+import { idpRowToAuditSnapshot } from "./audit.js";
 class AddIDPMutationResolver {
   constructor(idpManager) {
     this.idpManager = idpManager;
@@ -33,12 +38,24 @@ class AddIDPMutationResolver {
       options: {
         autoSignUp: args.options?.autoSignUp ?? false,
         exclusive: args.options?.exclusive ?? false,
-        initReturnsConfig: args.options?.initReturnsConfig ?? false
+        initReturnsConfig: args.options?.initReturnsConfig ?? false,
+        requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? false
       }
     });
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
+    const after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider));
+    await context.logAuthAction({
+      type: "idp_create",
+      response: new ResponseOk(null),
+      eventData: {
+        slug: args.identityProvider,
+        before: null,
+        after: idpRowToAuditSnapshot(after)
+      }
+    });
     return { ok: true };
   }
 }

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AddIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema'\nimport { PermissionActions } from '../../../model'\nimport { IDPManager } from '../../../model/service/idp/IDPManager'\nimport { createErrorResponse } from '../../errorUtils'\nimport { TenantResolverContext } from '../../TenantResolverContext'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAMO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,MAAA;AAAA,IACvD,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"AddIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/idp/DisableIDPMutationResolver.cjs

@@ -8,12 +8,15 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -32,6 +35,11 @@ class DisableIDPMutationResolver {
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
+    await context.logAuthAction({
+      type: "idp_disable",
+      response: new Response.ResponseOk(null),
+      eventData: { slug: args.identityProvider }
+    });
     return { ok: true };
   }
 }

package/dist/development/src/resolvers/mutation/idp/DisableIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema'\nimport { PermissionActions } from '../../../model'\nimport { IDPManager } from '../../../model/service/idp/IDPManager'\nimport { createErrorResponse } from '../../errorUtils'\nimport { TenantResolverContext } from '../../TenantResolverContext'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"DisableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}