@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs

@@ -8,12 +8,15 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 const token = require("../../../model/utils/token.cjs");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -38,14 +41,14 @@ class InviteMutationResolver {
     if (!project) {
       return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
     }
-    return this.doInvite(context.db, {
+    return this.doInvite(context, {
       email,
       project,
       memberships,
       name: name ?? void 0,
       emailVariant: options?.mailVariant || "",
       method: options?.method ?? "CREATE_PASSWORD"
-    });
+    }, { unmanaged: false });
   }
   async unmanagedInvite(parent, { projectSlug, email, memberships, password, options }, context) {
     const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
@@ -60,16 +63,16 @@ class InviteMutationResolver {
     if (typeof options?.resetTokenHash === "string" && !token.isTokenHash(options?.resetTokenHash)) {
       throw new graphqlUtils.UserInputError("Invalid format of resetTokenHash. Must be hex-encoded sha256.");
     }
-    return this.doInvite(context.db, {
+    return this.doInvite(context, {
       email,
       project,
       memberships,
       noEmail: true,
       password: password ?? options?.password ?? void 0,
       passwordResetTokenHash: options?.resetTokenHash ?? void 0
-    });
+    }, { unmanaged: true });
   }
-  async doInvite(dbContext, invite) {
+  async doInvite(context, invite, audit) {
     const validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships);
     if (validationResult.length > 0) {
       const errors = membershipUtils.createMembershipValidationErrorResult(validationResult);
@@ -79,11 +82,23 @@ class InviteMutationResolver {
         error: errors[0]
       };
     }
-    const response = await this.inviteManager.invite(dbContext, invite);
+    const response = await this.inviteManager.invite(context.db, invite);
     if (!response.ok) {
       return errorUtils.createErrorResponse(response.error, response.errorMessage);
     }
     const result = response.result;
+    await context.logAuthAction({
+      type: "person_invite",
+      response: new Response.ResponseOk(null),
+      targetPersonId: result.person.id,
+      personInput: invite.email,
+      eventData: {
+        projectSlug: invite.project.slug,
+        isNew: result.isNew,
+        unmanaged: audit.unmanaged,
+        memberships: invite.memberships.map(membershipToJson)
+      }
+    });
     return {
       ok: true,
       errors: [],
@@ -94,5 +109,9 @@ class InviteMutationResolver {
     };
   }
 }
+const membershipToJson = ({ role, variables }) => ({
+  role,
+  variables: variables.map(({ name, values }) => ({ name, values: [...values] }))
+});
 exports.InviteMutationResolver = InviteMutationResolver;
 //# sourceMappingURL=InviteMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { DatabaseContext, InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EACF;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAACC,kBAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAIC,aAAAA,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EACF;AAAA,EAEA,MAAc,SACb,WACA,QAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAElE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t}, { unmanaged: false })\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t}, { unmanaged: true })\n\t}\n\n\tprivate async doInvite(\n\t\tcontext: TenantResolverContext,\n\t\tinvite: InviteData,\n\t\taudit: { unmanaged: boolean },\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(context.db, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_invite',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: result.person.id,\n\t\t\tpersonInput: invite.email,\n\t\t\teventData: {\n\t\t\t\tprojectSlug: invite.project.slug,\n\t\t\t\tisNew: result.isNew,\n\t\t\t\tunmanaged: audit.unmanaged,\n\t\t\t\tmemberships: invite.memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,GACzB,EAAE,WAAW,OAAO;AAAA,EACxB;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAACC,kBAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAIC,aAAAA,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,GACjD,EAAE,WAAW,MAAM;AAAA,EACvB;AAAA,EAEA,MAAc,SACb,SACA,QACA,OAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI,MAAM;AAEnE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,aAAa,OAAO;AAAA,MACpB,WAAW;AAAA,QACV,aAAa,OAAO,QAAQ;AAAA,QAC5B,OAAO,OAAO;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,OAAO,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IACrD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js

@@ -6,12 +6,15 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import { isTokenHash } from "../../../model/utils/token.js";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -36,14 +39,14 @@ class InviteMutationResolver {
     if (!project) {
       return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
     }
-    return this.doInvite(context.db, {
+    return this.doInvite(context, {
       email,
       project,
       memberships,
       name: name ?? void 0,
       emailVariant: options?.mailVariant || "",
       method: options?.method ?? "CREATE_PASSWORD"
-    });
+    }, { unmanaged: false });
   }
   async unmanagedInvite(parent, { projectSlug, email, memberships, password, options }, context) {
     const project = await this.projectManager.getProjectBySlug(context.db, projectSlug);
@@ -58,16 +61,16 @@ class InviteMutationResolver {
     if (typeof options?.resetTokenHash === "string" && !isTokenHash(options?.resetTokenHash)) {
       throw new UserInputError("Invalid format of resetTokenHash. Must be hex-encoded sha256.");
     }
-    return this.doInvite(context.db, {
+    return this.doInvite(context, {
       email,
       project,
       memberships,
       noEmail: true,
       password: password ?? options?.password ?? void 0,
       passwordResetTokenHash: options?.resetTokenHash ?? void 0
-    });
+    }, { unmanaged: true });
   }
-  async doInvite(dbContext, invite) {
+  async doInvite(context, invite, audit) {
     const validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships);
     if (validationResult.length > 0) {
       const errors = createMembershipValidationErrorResult(validationResult);
@@ -77,11 +80,23 @@ class InviteMutationResolver {
         error: errors[0]
       };
     }
-    const response = await this.inviteManager.invite(dbContext, invite);
+    const response = await this.inviteManager.invite(context.db, invite);
     if (!response.ok) {
       return createErrorResponse(response.error, response.errorMessage);
     }
     const result = response.result;
+    await context.logAuthAction({
+      type: "person_invite",
+      response: new ResponseOk(null),
+      targetPersonId: result.person.id,
+      personInput: invite.email,
+      eventData: {
+        projectSlug: invite.project.slug,
+        isNew: result.isNew,
+        unmanaged: audit.unmanaged,
+        memberships: invite.memberships.map(membershipToJson)
+      }
+    });
     return {
       ok: true,
       errors: [],
@@ -92,6 +107,10 @@ class InviteMutationResolver {
     };
   }
 }
+const membershipToJson = ({ role, variables }) => ({
+  role,
+  variables: variables.map(({ name, values }) => ({ name, values: [...values] }))
+});
 export {
   InviteMutationResolver
 };

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { DatabaseContext, InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t})\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context.db, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t})\n\t}\n\n\tprivate async doInvite(\n\t\tdbContext: DatabaseContext,\n\t\tinvite: InviteData,\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(dbContext, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,CAC3B;AAAA,EACF;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAI,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,QAAQ,IAAI;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,CACnD;AAAA,EACF;AAAA,EAEA,MAAc,SACb,WACA,QAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,WAAW,MAAM;AAElE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;"}
+{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t}, { unmanaged: false })\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t}, { unmanaged: true })\n\t}\n\n\tprivate async doInvite(\n\t\tcontext: TenantResolverContext,\n\t\tinvite: InviteData,\n\t\taudit: { unmanaged: boolean },\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(context.db, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_invite',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: result.person.id,\n\t\t\tpersonInput: invite.email,\n\t\t\teventData: {\n\t\t\t\tprojectSlug: invite.project.slug,\n\t\t\t\tisNew: result.isNew,\n\t\t\t\tunmanaged: audit.unmanaged,\n\t\t\t\tmemberships: invite.memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,GACzB,EAAE,WAAW,OAAO;AAAA,EACxB;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAI,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,GACjD,EAAE,WAAW,MAAM;AAAA,EACvB;AAAA,EAEA,MAAc,SACb,SACA,QACA,OAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI,MAAM;AAEnE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,aAAa,OAAO;AAAA,MACpB,WAAW;AAAA,QACV,aAAa,OAAO,QAAQ;AAAA,QAC5B,OAAO,OAAO;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,OAAO,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IACrD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs

@@ -13,29 +13,26 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class OtpMutationResolver {
-  constructor(otpManager) {
+  constructor(otpManager, backupCodeManager, authPolicyResolver) {
     this.otpManager = otpManager;
+    this.backupCodeManager = backupCodeManager;
+    this.authPolicyResolver = authPolicyResolver;
   }
   async prepareOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
     const otp = await this.otpManager.prepareOtp(context.db, person, args.label || "Contember");
-    if (person.otp_activated_at) {
-      await context.logAuthAction({
-        type: "2fa_disable",
-        response: new Response.ResponseOk(null),
-        personId: person.id
-      });
-    }
     return {
       ok: true,
       result: {
@@ -46,13 +43,13 @@ class OtpMutationResolver {
   }
   async confirmOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
+    if (!person.otp_pending_secret) {
       return errorUtils.createErrorResponse(
         "NOT_PREPARED",
         `OTP setup was not initialized. Call prepareOtp first.`
       );
     }
-    if (!this.otpManager.verifyOtp(person, args.otpToken)) {
+    if (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {
       const responseError = new Response.ResponseError("INVALID_OTP_TOKEN", "Provided token is not correct.");
       await context.logAuthAction({
         type: "2fa_enable",
@@ -67,17 +64,34 @@ class OtpMutationResolver {
       response: new Response.ResponseOk(null),
       personId: person.id
     });
+    const backupCodes = await this.backupCodeManager.generate(context.db, person.id);
+    await context.logAuthAction({
+      type: "backup_code_generated",
+      response: new Response.ResponseOk(null),
+      personId: person.id
+    });
     return {
       ok: true,
-      errors: []
+      errors: [],
+      result: {
+        backupCodes
+      }
     };
   }
   async disableOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
+    if (!person.otp_secret) {
       return errorUtils.createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot disable it.");
     }
+    const wouldHaveNoFactor = !person.email_otp_enabled;
+    if (wouldHaveNoFactor) {
+      const policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles);
+      if (policy.mfaRequired) {
+        return errorUtils.createErrorResponse("MFA_REQUIRED", "MFA is required for your role; you cannot disable your only factor.");
+      }
+    }
     await this.otpManager.disableOtp(context.db, person);
+    await this.backupCodeManager.deleteForPerson(context.db, person.id);
     await context.logAuthAction({
       type: "2fa_disable",
       response: new Response.ResponseOk(null),

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\tif (person.otp_activated_at) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_disable',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["ResponseOk","createErrorResponse","ResponseError","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAyB;AAAA,EAEtD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,QAAI,OAAO,kBAAkB;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAOC,WAAAA;AAAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AACtD,YAAM,gBAAgB,IAAIC,uBAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAOD,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAID,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAOC,WAAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAID,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyResolver, BackupCodeManager, OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_pending_secret) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Promoting pending->active enrolls (or rotates) TOTP; (re)issue the backup-code set.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_secret) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\t// Rotation (prepareOtp + confirmOtp) stays open — only removal is blocked.\n\t\tconst wouldHaveNoFactor = !person.email_otp_enabled\n\t\tif (wouldHaveNoFactor) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ResponseError","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,YACA,mBACA,oBAChB;AAHgB,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,oBAAoB;AAC/B,aAAOA,WAAAA;AAAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,KAAK,QAAQ,GAAG;AACnE,YAAM,gBAAgB,IAAIC,uBAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAOD,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,YAAY;AACvB,aAAOF,WAAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AAGA,UAAM,oBAAoB,CAAC,OAAO;AAClC,QAAI,mBAAmB;AACtB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAOA,WAAAA,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAClE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js

@@ -7,33 +7,30 @@ import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
 import { ImplementationException } from "../../../exceptions.js";
-import { ResponseOk, ResponseError } from "../../../model/utils/Response.js";
+import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class OtpMutationResolver {
-  constructor(otpManager) {
+  constructor(otpManager, backupCodeManager, authPolicyResolver) {
     this.otpManager = otpManager;
+    this.backupCodeManager = backupCodeManager;
+    this.authPolicyResolver = authPolicyResolver;
   }
   async prepareOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
     const otp = await this.otpManager.prepareOtp(context.db, person, args.label || "Contember");
-    if (person.otp_activated_at) {
-      await context.logAuthAction({
-        type: "2fa_disable",
-        response: new ResponseOk(null),
-        personId: person.id
-      });
-    }
     return {
       ok: true,
       result: {
@@ -44,13 +41,13 @@ class OtpMutationResolver {
   }
   async confirmOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
+    if (!person.otp_pending_secret) {
       return createErrorResponse(
         "NOT_PREPARED",
         `OTP setup was not initialized. Call prepareOtp first.`
       );
     }
-    if (!this.otpManager.verifyOtp(person, args.otpToken)) {
+    if (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {
       const responseError = new ResponseError("INVALID_OTP_TOKEN", "Provided token is not correct.");
       await context.logAuthAction({
         type: "2fa_enable",
@@ -65,17 +62,34 @@ class OtpMutationResolver {
       response: new ResponseOk(null),
       personId: person.id
     });
+    const backupCodes = await this.backupCodeManager.generate(context.db, person.id);
+    await context.logAuthAction({
+      type: "backup_code_generated",
+      response: new ResponseOk(null),
+      personId: person.id
+    });
     return {
       ok: true,
-      errors: []
+      errors: [],
+      result: {
+        backupCodes
+      }
     };
   }
   async disableOtp(parent, args, context) {
     const person = await this.getPersonFromContext(context);
-    if (!person.otp_uri) {
+    if (!person.otp_secret) {
       return createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot disable it.");
     }
+    const wouldHaveNoFactor = !person.email_otp_enabled;
+    if (wouldHaveNoFactor) {
+      const policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles);
+      if (policy.mfaRequired) {
+        return createErrorResponse("MFA_REQUIRED", "MFA is required for your role; you cannot disable your only factor.");
+      }
+    }
     await this.otpManager.disableOtp(context.db, person);
+    await this.backupCodeManager.deleteForPerson(context.db, person.id);
     await context.logAuthAction({
       type: "2fa_disable",
       response: new ResponseOk(null),

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'\nimport { ImplementationException } from '../../../exceptions'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly otpManager: OtpManager) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\tif (person.otp_activated_at) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_disable',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!this.otpManager.verifyOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_uri) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAAyB;AAAA,EAEtD,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,QAAI,OAAO,kBAAkB;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,KAAK,WAAW,UAAU,QAAQ,KAAK,QAAQ,GAAG;AACtD,YAAM,gBAAgB,IAAI,cAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAO,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyResolver, BackupCodeManager, OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_pending_secret) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Promoting pending->active enrolls (or rotates) TOTP; (re)issue the backup-code set.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_secret) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\t// Rotation (prepareOtp + confirmOtp) stays open — only removal is blocked.\n\t\tconst wouldHaveNoFactor = !person.email_otp_enabled\n\t\tif (wouldHaveNoFactor) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,YACA,mBACA,oBAChB;AAHgB,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,oBAAoB;AAC/B,aAAO;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,KAAK,QAAQ,GAAG;AACnE,YAAM,gBAAgB,IAAI,cAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAO,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,YAAY;AACvB,aAAO,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AAGA,UAAM,oBAAoB,CAAC,OAAO;AAClC,QAAI,mBAAmB;AACtB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAO,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAClE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs

@@ -11,25 +11,45 @@ require("node:crypto");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class PasswordlessMutationResolver {
-  constructor(passwordlessSignInManager, signInResponseFactory) {
+  constructor(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter) {
     this.passwordlessSignInManager = passwordlessSignInManager;
     this.signInResponseFactory = signInResponseFactory;
+    this.captchaValidator = captchaValidator;
+    this.rateLimiter = rateLimiter;
   }
   async initSignInPasswordless(parent, args, context) {
     await context.requireAccess({
       action: PermissionActions.PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,
       message: "You are not allowed to request passwordless sign in"
     });
+    const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(context.db.providers));
+    const rl = await this.rateLimiter.consume(context.db, "passwordless_init_per_ip", context.httpInfo.ip, configuration);
+    if (!rl.ok) {
+      return errorUtils.createErrorResponse("RATE_LIMIT_EXCEEDED", `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`);
+    }
+    const captchaConfig = this.captchaValidator.extractConfig(configuration);
+    if (this.captchaValidator.isEnabledFor(captchaConfig, "passwordlessInit")) {
+      const captcha = await this.captchaValidator.verify({
+        config: captchaConfig,
+        token: args.captchaToken ?? void 0,
+        remoteIp: context.httpInfo.ip
+      });
+      if (!captcha.ok) {
+        return errorUtils.createErrorResponse("INVALID_CAPTCHA", `Captcha verification failed: ${captcha.reason}`);
+      }
+    }
     const result = await this.passwordlessSignInManager.initSignInPasswordless({
       db: context.db,
       permissionContext: context.permissionContext,
@@ -42,11 +62,8 @@ class PasswordlessMutationResolver {
       response: result
     });
     if (!result.ok) {
-      if (result.error === "PERSON_NOT_FOUND") {
-        const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
-        if (!configuration.login.revealUserExists) {
-          return errorUtils.createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
-        }
+      if (result.error === "PERSON_NOT_FOUND" && !configuration.login.revealUserExists) {
+        return errorUtils.createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
       }
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
@@ -62,13 +79,23 @@ class PasswordlessMutationResolver {
       requestId: args.requestId,
       token: args.token,
       mfaOtp: args.mfaOtp ?? void 0,
+      backupCode: args.backupCode ?? void 0,
       validationType: args.validationType,
-      expiration: args.expiration ?? void 0
+      expiration: args.expiration ?? void 0,
+      requestInfo: context.httpInfo,
+      trustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo
     });
     await context.logAuthAction({
       type: "passwordless_login",
       response: signIn
     });
+    if (signIn.ok && signIn.result.usedBackupCode) {
+      await context.logAuthAction({
+        type: "backup_code_used",
+        response: signIn,
+        personId: signIn.result.person.id
+      });
+    }
     if (!signIn.ok) {
       return errorUtils.createErrorResponse(signIn.error, signIn.errorMessage);
     }

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND') {\n\t\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,oBAAoB;AACxC,cAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,YAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,iBAAOC,WAAAA,oBAAoB,yBAAyB,kDAAkD;AAAA,QACvG;AAAA,MACD;AAEA,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CaptchaValidator, ConfigurationQuery, PermissionActions, RateLimiter } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager.js'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'passwordless_init_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordlessInit')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND' && !configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tbackupCode: args.backupCode ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t\trequestInfo: context.httpInfo,\n\t\t\ttrustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (signIn.ok && signIn.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse: signIn,\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBACA,kBACA,aAChB;AAJgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,4BAA4B,QAAQ,SAAS,IAAI,aAAa;AACpH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,uDAAuD,GAAG,iBAAiB,IAAI;AAAA,IAClI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,kBAAkB,GAAG;AAC1E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,sBAAsB,CAAC,cAAc,MAAM,kBAAkB;AAEjF,eAAOA,WAAAA,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAEA,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,QAAQ;AAAA,MACrB,oBAAoB,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA,CAC/E;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,MAAM,OAAO,OAAO,gBAAgB;AAC9C,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO,OAAO,OAAO;AAAA,MAAA,CAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}