@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/production/src/resolvers/mutation/person/SignOutMutationResolver.js

@@ -3,47 +3,50 @@ import "@contember/authorization";
 import "../../../model/authorization/PermissionContext.js";
 import "../../../model/authorization/PermissionsFactory.js";
 import "@contember/schema";
-import { ApiKey } from "../../../model/type/ApiKey.js";
+import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class SignOutMutationResolver {
-  constructor(apiKeyManager) {
-    this.apiKeyManager = apiKeyManager;
+  constructor(signOutManager) {
+    this.signOutManager = signOutManager;
   }
   async signOut(parent, args, context) {
-    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
-    if (!person) {
-      return createErrorResponse("NOT_A_PERSON", "Only a person can sign out");
-    }
-    const personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId);
-    if (personApiKeyId?.type === ApiKey.Type.PERMANENT) {
-      return createErrorResponse(
-        "NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY",
-        "Only session API keys can be used for person sign out."
-      );
-    }
     await context.requireAccess({
       action: PermissionActions.PERSON_SIGN_OUT,
       message: "You are not allowed to sign out"
     });
-    if (args.all) {
-      await this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id);
-    } else {
-      await this.apiKeyManager.disableApiKey(context.db, context.apiKeyId);
+    const response = await this.signOutManager.signOut(
+      context.db,
+      context.identity.id,
+      context.apiKeyId,
+      args.all ?? false
+    );
+    if (!response.ok) {
+      return createErrorResponse(response.error, response.errorMessage);
+    }
+    if (response.result.logoutUrl) {
+      await context.logAuthAction({
+        type: "idp_logout_initiated",
+        response: new ResponseOk(null),
+        identityProviderId: response.result.identityProviderId ?? void 0,
+        eventData: { all: args.all ?? false }
+      });
     }
-    return { ok: true, errors: [] };
+    return { ok: true, errors: [], logoutUrl: response.result.logoutUrl };
   }
 }
 export {

package/dist/production/src/resolvers/mutation/person/SignOutMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKeyId = await this.apiKeyManager.findApiKey(context.db, context.apiKeyId)\n\n\t\tif (personApiKeyId?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tif (args.all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, context.identity.id)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(context.db, context.apiKeyId)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAKO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAE9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,4BAA4B;AAAA,IACxE;AAEA,UAAM,iBAAiB,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,QAAQ,QAAQ;AAEvF,QAAI,gBAAgB,SAAS,OAAO,KAAK,WAAW;AACnD,aAAO;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,QAAI,KAAK,KAAK;AACb,YAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,QAAQ,SAAS,EAAE;AAAA,IAChF,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IACpE;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AACD;"}
+{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;"}

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.cjs

@@ -8,13 +8,18 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 const Password = require("../../../model/dtos/Password.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -23,9 +28,13 @@ const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");
 const PersonResponseFactory = require("../../responseHelpers/PersonResponseFactory.cjs");
 class SignUpMutationResolver {
-  constructor(signUpManager, apiKeyManager) {
+  constructor(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory) {
     this.signUpManager = signUpManager;
     this.apiKeyManager = apiKeyManager;
+    this.captchaValidator = captchaValidator;
+    this.rateLimiter = rateLimiter;
+    this.emailVerificationManager = emailVerificationManager;
+    this.permissionContextFactory = permissionContextFactory;
   }
   async signUp(parent, args, context) {
     const roles = args.roles ?? [];
@@ -33,6 +42,24 @@ class SignUpMutationResolver {
       action: PermissionActions.PermissionActions.PERSON_SIGN_UP(roles),
       message: "You are not allowed to sign up"
     });
+    const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(context.db.providers));
+    const rl = await this.rateLimiter.consume(context.db, "sign_up_per_ip", context.httpInfo.ip, configuration);
+    if (!rl.ok) {
+      return errorUtils.createErrorResponse(
+        new Response.ResponseError("RATE_LIMIT_EXCEEDED", `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`)
+      );
+    }
+    const captchaConfig = this.captchaValidator.extractConfig(configuration);
+    if (this.captchaValidator.isEnabledFor(captchaConfig, "signUp")) {
+      const captcha = await this.captchaValidator.verify({
+        config: captchaConfig,
+        token: args.captchaToken ?? void 0,
+        remoteIp: context.httpInfo.ip
+      });
+      if (!captcha.ok) {
+        return errorUtils.createErrorResponse("INVALID_CAPTCHA", `Captcha verification failed: ${captcha.reason}`);
+      }
+    }
     const password = (() => {
       if (args.password) {
         return new Password.PasswordPlain(args.password);
@@ -49,13 +76,32 @@ class SignUpMutationResolver {
       email: args.email,
       name: args.name ?? void 0,
       password,
-      roles
+      roles,
+      config: configuration
     });
     if (!response.ok) {
       return errorUtils.createErrorResponse(response);
     }
     const result = response.result;
     await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId);
+    if (result.emailVerificationRequired) {
+      const personRow = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byId(result.person.id));
+      if (personRow?.email) {
+        const permissionContext = await this.permissionContextFactory.create(context.db, {
+          id: personRow.identity_id,
+          roles: personRow.roles
+        });
+        const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow);
+        if (sent) {
+          await context.logAuthAction({
+            type: "email_verify_init",
+            response: new Response.ResponseOk(null),
+            personId: personRow.id,
+            personInput: personRow.email
+          });
+        }
+      }
+    }
     return {
       ok: true,
       errors: [],

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKeyManager, NoPassword, PasswordHash, PasswordPlain, PermissionActions, SignUpManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","PasswordPlain","UserInputError","PasswordHash","NoPassword","createErrorResponse","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE3G,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAIC,SAAAA,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAIC,aAAAA,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAOC,SAAAA;AAAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","PasswordPlain","UserInputError","PasswordHash","NoPassword","PersonQuery","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOD,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAIE,SAAAA,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAIC,aAAAA,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAOC,SAAAA;AAAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOL,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAMM,YAAAA,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.js

@@ -6,13 +6,18 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
 import { PasswordPlain, PasswordHash, NoPassword } from "../../../model/dtos/Password.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -21,9 +26,13 @@ import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";
 import { PersonResponseFactory } from "../../responseHelpers/PersonResponseFactory.js";
 class SignUpMutationResolver {
-  constructor(signUpManager, apiKeyManager) {
+  constructor(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory) {
     this.signUpManager = signUpManager;
     this.apiKeyManager = apiKeyManager;
+    this.captchaValidator = captchaValidator;
+    this.rateLimiter = rateLimiter;
+    this.emailVerificationManager = emailVerificationManager;
+    this.permissionContextFactory = permissionContextFactory;
   }
   async signUp(parent, args, context) {
     const roles = args.roles ?? [];
@@ -31,6 +40,24 @@ class SignUpMutationResolver {
       action: PermissionActions.PERSON_SIGN_UP(roles),
       message: "You are not allowed to sign up"
     });
+    const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers));
+    const rl = await this.rateLimiter.consume(context.db, "sign_up_per_ip", context.httpInfo.ip, configuration);
+    if (!rl.ok) {
+      return createErrorResponse(
+        new ResponseError("RATE_LIMIT_EXCEEDED", `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`)
+      );
+    }
+    const captchaConfig = this.captchaValidator.extractConfig(configuration);
+    if (this.captchaValidator.isEnabledFor(captchaConfig, "signUp")) {
+      const captcha = await this.captchaValidator.verify({
+        config: captchaConfig,
+        token: args.captchaToken ?? void 0,
+        remoteIp: context.httpInfo.ip
+      });
+      if (!captcha.ok) {
+        return createErrorResponse("INVALID_CAPTCHA", `Captcha verification failed: ${captcha.reason}`);
+      }
+    }
     const password = (() => {
       if (args.password) {
         return new PasswordPlain(args.password);
@@ -47,13 +74,32 @@ class SignUpMutationResolver {
       email: args.email,
       name: args.name ?? void 0,
       password,
-      roles
+      roles,
+      config: configuration
     });
     if (!response.ok) {
       return createErrorResponse(response);
     }
     const result = response.result;
     await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId);
+    if (result.emailVerificationRequired) {
+      const personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id));
+      if (personRow?.email) {
+        const permissionContext = await this.permissionContextFactory.create(context.db, {
+          id: personRow.identity_id,
+          roles: personRow.roles
+        });
+        const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow);
+        if (sent) {
+          await context.logAuthAction({
+            type: "email_verify_init",
+            response: new ResponseOk(null),
+            personId: personRow.id,
+            personInput: personRow.email
+          });
+        }
+      }
+    }
     return {
       ok: true,
       errors: [],

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ApiKeyManager, NoPassword, PasswordHash, PasswordPlain, PermissionActions, SignUpManager } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,eAA+C,eAA8B;AAA7E,SAAA,gBAAA;AAA+C,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE3G,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AACD,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAI,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAI,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAI,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAO;AAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;"}
+{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAI,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAI,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAI,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAO;AAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAI,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;"}

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs

@@ -12,10 +12,12 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -41,7 +43,7 @@ class TogglePasswordlessMutationResolver {
       action: PermissionActions.PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
       message: "You are not allowed to enable passwordless"
     });
-    const config = await await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const config = await await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(context.db.providers));
     if (config.passwordless?.enabled === "always" || config.passwordless?.enabled === "never") {
       return errorUtils.createErrorResponse("CANNOT_TOGGLE", "Passwordless is configured globally and cannot be toggled");
     }

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACjF,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAOF,WAAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAOF,WAAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js

@@ -10,10 +10,12 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -39,7 +41,7 @@ class TogglePasswordlessMutationResolver {
       action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
       message: "You are not allowed to enable passwordless"
     });
-    const config = await await context.db.queryHandler.fetch(new ConfigurationQuery());
+    const config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers));
     if (config.passwordless?.enabled === "always" || config.passwordless?.enabled === "never") {
       return createErrorResponse("CANNOT_TOGGLE", "Passwordless is configured globally and cannot be toggled");
     }

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AACjF,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAO,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAO,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs

@@ -9,12 +9,15 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 const token = require("../../../model/utils/token.cjs");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -57,6 +60,15 @@ class CreateProjectMutationResolver {
     if (!response.ok) {
       return errorUtils.createErrorResponse(response.error, response.errorMessage);
     }
+    await context.logAuthAction({
+      type: "project_create",
+      response: new Response.ResponseOk(null),
+      eventData: {
+        slug: projectSlug,
+        name: name || projectSlug,
+        secretKeys: (secrets ?? []).map((it) => it.key).sort()
+      }
+    });
     return {
       ok: true,
       error: null,

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAAA,YAAY,eAAe,GAAG;AACzE,YAAM,IAAIC,aAAAA,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAAA,YAAY,eAAe,GAAG;AACzE,YAAM,IAAIC,aAAAA,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIK,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.js

@@ -7,12 +7,15 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import { isTokenHash } from "../../../model/utils/token.js";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -55,6 +58,15 @@ class CreateProjectMutationResolver {
     if (!response.ok) {
       return createErrorResponse(response.error, response.errorMessage);
     }
+    await context.logAuthAction({
+      type: "project_create",
+      response: new ResponseOk(null),
+      eventData: {
+        slug: projectSlug,
+        name: name || projectSlug,
+        secretKeys: (secrets ?? []).map((it) => it.key).sort()
+      }
+    });
     return {
       ok: true,
       error: null,

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { UserInputError } from '@contember/graphql-utils'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACzE,YAAM,IAAI,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;"}
+{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACzE,YAAM,IAAI,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;"}

package/dist/production/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs

@@ -8,12 +8,15 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");
@@ -35,6 +38,14 @@ class SetProjectSecretMutationResolver {
       return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", args.projectSlug);
     }
     await this.secretManager.setSecret(context.db, project.id, args.key, args.value);
+    await context.logAuthAction({
+      type: "project_secret_change",
+      response: new Response.ResponseOk(null),
+      eventData: {
+        slug: project.slug,
+        key: args.key
+      }
+    });
     return { ok: true };
   }
 }

package/dist/production/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model'\nimport { createProjectNotFoundResponse } from '../../errorUtils'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAWO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAC/E,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SetProjectSecretMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/project/SetProjectSecretMutationResolver.js

@@ -6,12 +6,15 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
 import "@contember/schema-utils";
@@ -33,6 +36,14 @@ class SetProjectSecretMutationResolver {
       return createProjectNotFoundResponse("PROJECT_NOT_FOUND", args.projectSlug);
     }
     await this.secretManager.setSecret(context.db, project.id, args.key, args.value);
+    await context.logAuthAction({
+      type: "project_secret_change",
+      response: new ResponseOk(null),
+      eventData: {
+        slug: project.slug,
+        key: args.key
+      }
+    });
     return { ok: true };
   }
 }

package/dist/production/src/resolvers/mutation/project/SetProjectSecretMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model'\nimport { createProjectNotFoundResponse } from '../../errorUtils'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAWO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAC/E,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"SetProjectSecretMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}