@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/person/PasswordlessMutationResolver.js

@@ -1,33 +1,55 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class PasswordlessMutationResolver {
-  constructor(passwordlessSignInManager, signInResponseFactory) {
+  constructor(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter) {
     this.passwordlessSignInManager = passwordlessSignInManager;
     this.signInResponseFactory = signInResponseFactory;
+    this.captchaValidator = captchaValidator;
+    this.rateLimiter = rateLimiter;
   }
   async initSignInPasswordless(parent, args, context) {
     await context.requireAccess({
       action: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,
       message: "You are not allowed to request passwordless sign in"
     });
+    const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers));
+    const rl = await this.rateLimiter.consume(context.db, "passwordless_init_per_ip", context.httpInfo.ip, configuration);
+    if (!rl.ok) {
+      return createErrorResponse("RATE_LIMIT_EXCEEDED", `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`);
+    }
+    const captchaConfig = this.captchaValidator.extractConfig(configuration);
+    if (this.captchaValidator.isEnabledFor(captchaConfig, "passwordlessInit")) {
+      const captcha = await this.captchaValidator.verify({
+        config: captchaConfig,
+        token: args.captchaToken ?? void 0,
+        remoteIp: context.httpInfo.ip
+      });
+      if (!captcha.ok) {
+        return createErrorResponse("INVALID_CAPTCHA", `Captcha verification failed: ${captcha.reason}`);
+      }
+    }
     const result = await this.passwordlessSignInManager.initSignInPasswordless({
       db: context.db,
       permissionContext: context.permissionContext,
@@ -40,11 +62,12 @@ class PasswordlessMutationResolver {
       response: result
     });
     if (!result.ok) {
-      if (result.error === "PERSON_NOT_FOUND") {
-        const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
-        if (!configuration.login.revealUserExists) {
-          return createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
-        }
+      if (result.error === "PERSON_NOT_FOUND" && !configuration.login.revealUserExists) {
+        return createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+      }
+      const { revealUserExists, revealLoginMethod } = configuration.login;
+      if (result.error === "IDP_REQUIRED" && !(revealUserExists && revealLoginMethod)) {
+        return createErrorResponse("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
       }
       return createErrorResponse(result.error, result.errorMessage);
     }
@@ -60,13 +83,23 @@ class PasswordlessMutationResolver {
       requestId: args.requestId,
       token: args.token,
       mfaOtp: args.mfaOtp ?? void 0,
+      backupCode: args.backupCode ?? void 0,
       validationType: args.validationType,
-      expiration: args.expiration ?? void 0
+      expiration: args.expiration ?? void 0,
+      requestInfo: context.httpInfo,
+      trustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo
     });
     await context.logAuthAction({
       type: "passwordless_login",
       response: signIn
     });
+    if (signIn.ok && signIn.result.usedBackupCode) {
+      await context.logAuthAction({
+        type: "backup_code_used",
+        response: signIn,
+        personId: signIn.result.person.id
+      });
+    }
     if (!signIn.ok) {
       return createErrorResponse(signIn.error, signIn.errorMessage);
     }

package/dist/production/src/resolvers/mutation/person/PasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PermissionActions } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND') {\n\t\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBAChB;AAFgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,oBAAoB;AACxC,cAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,YAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,iBAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,QACvG;AAAA,MACD;AAEA,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,IAAA,CAC/B;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CaptchaValidator, ConfigurationQuery, PermissionActions, RateLimiter } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager.js'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'passwordless_init_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordlessInit')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND' && !configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\t\t\t// Naming the provider tells the caller both that the person exists and how\n\t\t\t// they authenticate, so it needs both reveal flags. PASSWORDLESS_DISABLED is\n\t\t\t// the neutral answer this endpoint already gives for an unknown address.\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tif (result.error === 'IDP_REQUIRED' && !(revealUserExists && revealLoginMethod)) {\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tbackupCode: args.backupCode ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t\trequestInfo: context.httpInfo,\n\t\t\ttrustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (signIn.ok && signIn.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse: signIn,\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBACA,kBACA,aAChB;AAJgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,4BAA4B,QAAQ,SAAS,IAAI,aAAa;AACpH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,uDAAuD,GAAG,iBAAiB,IAAI;AAAA,IAClI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,kBAAkB,GAAG;AAC1E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,sBAAsB,CAAC,cAAc,MAAM,kBAAkB;AAEjF,eAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAIA,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,UAAI,OAAO,UAAU,kBAAkB,EAAE,oBAAoB,oBAAoB;AAChF,eAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAEA,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,QAAQ;AAAA,MACrB,oBAAoB,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA,CAC/E;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,MAAM,OAAO,OAAO,gBAAgB;AAC9C,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO,OAAO,OAAO;AAAA,MAAA,CAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.cjs

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const exceptions = require("../../../exceptions.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
+require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class RegenerateBackupCodesMutationResolver {
+  constructor(backupCodeManager) {
+    this.backupCodeManager = backupCodeManager;
+  }
+  async regenerateBackupCodes(parent, args, context) {
+    const person = await this.getPersonFromContext(context);
+    if (!person.otp_secret || !person.otp_activated_at) {
+      return errorUtils.createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot regenerate backup codes.");
+    }
+    const backupCodes = await this.backupCodeManager.generate(context.db, person.id);
+    await context.logAuthAction({
+      type: "backup_code_regenerated",
+      response: new Response.ResponseOk(null),
+      personId: person.id
+    });
+    return {
+      ok: true,
+      result: {
+        backupCodes
+      }
+    };
+  }
+  async getPersonFromContext(context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_SETUP_OTP,
+      message: "You are not allowed to setup a OTP"
+    });
+    const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      throw new exceptions.ImplementationException("Person should exists");
+    }
+    return person;
+  }
+}
+exports.RegenerateBackupCodesMutationResolver = RegenerateBackupCodesMutationResolver;
+//# sourceMappingURL=RegenerateBackupCodesMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegenerateBackupCodesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, RegenerateBackupCodesResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RegenerateBackupCodesMutationResolver implements Pick<MutationResolvers, 'regenerateBackupCodes'> {\n\tconstructor(private readonly backupCodeManager: BackupCodeManager) {}\n\n\tasync regenerateBackupCodes(parent: any, args: {}, context: TenantResolverContext): Promise<RegenerateBackupCodesResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\t// Backup codes only exist alongside an active TOTP factor.\n\t\tif (!person.otp_secret || !person.otp_activated_at) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot regenerate backup codes.')\n\t\t}\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_regenerated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,sCAAkG;AAAA,EAC9G,YAA6B,mBAAsC;AAAtC,SAAA,oBAAA;AAAA,EAAuC;AAAA,EAEpE,MAAM,sBAAsB,QAAa,MAAU,SAAwE;AAC1H,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAEtD,QAAI,CAAC,OAAO,cAAc,CAAC,OAAO,kBAAkB;AACnD,aAAOA,WAAAA,oBAAoB,kBAAkB,wDAAwD;AAAA,IACtG;AACA,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.js

@@ -0,0 +1,64 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ImplementationException } from "../../../exceptions.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
+import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class RegenerateBackupCodesMutationResolver {
+  constructor(backupCodeManager) {
+    this.backupCodeManager = backupCodeManager;
+  }
+  async regenerateBackupCodes(parent, args, context) {
+    const person = await this.getPersonFromContext(context);
+    if (!person.otp_secret || !person.otp_activated_at) {
+      return createErrorResponse("OTP_NOT_ACTIVE", "OTP is not active, you cannot regenerate backup codes.");
+    }
+    const backupCodes = await this.backupCodeManager.generate(context.db, person.id);
+    await context.logAuthAction({
+      type: "backup_code_regenerated",
+      response: new ResponseOk(null),
+      personId: person.id
+    });
+    return {
+      ok: true,
+      result: {
+        backupCodes
+      }
+    };
+  }
+  async getPersonFromContext(context) {
+    await context.requireAccess({
+      action: PermissionActions.PERSON_SETUP_OTP,
+      message: "You are not allowed to setup a OTP"
+    });
+    const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id));
+    if (!person) {
+      throw new ImplementationException("Person should exists");
+    }
+    return person;
+  }
+}
+export {
+  RegenerateBackupCodesMutationResolver
+};
+//# sourceMappingURL=RegenerateBackupCodesMutationResolver.js.map

package/dist/production/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegenerateBackupCodesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, RegenerateBackupCodesResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RegenerateBackupCodesMutationResolver implements Pick<MutationResolvers, 'regenerateBackupCodes'> {\n\tconstructor(private readonly backupCodeManager: BackupCodeManager) {}\n\n\tasync regenerateBackupCodes(parent: any, args: {}, context: TenantResolverContext): Promise<RegenerateBackupCodesResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\t// Backup codes only exist alongside an active TOTP factor.\n\t\tif (!person.otp_secret || !person.otp_activated_at) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot regenerate backup codes.')\n\t\t}\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_regenerated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,sCAAkG;AAAA,EAC9G,YAA6B,mBAAsC;AAAtC,SAAA,oBAAA;AAAA,EAAuC;AAAA,EAEpE,MAAM,sBAAsB,QAAa,MAAU,SAAwE;AAC1H,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAEtD,QAAI,CAAC,OAAO,cAAc,CAAC,OAAO,kBAAkB;AACnD,aAAO,oBAAoB,kBAAkB,wDAAwD;AAAA,IACtG;AACA,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs

@@ -2,36 +2,58 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ResetPasswordMutationResolver {
-  constructor(passwordResetManager, permissionContextFactory) {
+  constructor(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter) {
     this.passwordResetManager = passwordResetManager;
     this.permissionContextFactory = permissionContextFactory;
+    this.captchaValidator = captchaValidator;
+    this.rateLimiter = rateLimiter;
   }
   async createResetPasswordRequest(parent, args, context, info) {
     await context.requireAccess({
       action: PermissionActions.PermissionActions.PERSON_RESET_PASSWORD,
       message: "You are not allowed to initialize reset password request"
     });
+    const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(context.db.providers));
+    const rl = await this.rateLimiter.consume(context.db, "password_reset_per_ip", context.httpInfo.ip, configuration);
+    if (!rl.ok) {
+      return errorUtils.createErrorResponse("RATE_LIMIT_EXCEEDED", `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`);
+    }
+    const captchaConfig = this.captchaValidator.extractConfig(configuration);
+    if (this.captchaValidator.isEnabledFor(captchaConfig, "passwordReset")) {
+      const captcha = await this.captchaValidator.verify({
+        config: captchaConfig,
+        token: args.captchaToken ?? void 0,
+        remoteIp: context.httpInfo.ip
+      });
+      if (!captcha.ok) {
+        return errorUtils.createErrorResponse("INVALID_CAPTCHA", `Captcha verification failed: ${captcha.reason}`);
+      }
+    }
     const person = await context.db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(args.email));
     if (!person) {
       const responseError = new Response.ResponseError("PERSON_NOT_FOUND", `Person with email ${args.email} was not found.`);
@@ -40,7 +62,6 @@ class ResetPasswordMutationResolver {
         response: responseError,
         personInput: args.email
       });
-      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
       if (!configuration.login.revealUserExists) {
         return { ok: true, errors: [] };
       }
@@ -49,7 +70,7 @@ class ResetPasswordMutationResolver {
     const permissionContext = await this.permissionContextFactory.create(context.db, {
       id: person.identity_id,
       roles: person.roles
-    });
+    }, context.permissionContext.authorizator);
     await this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {
       mailVariant: args.options?.mailVariant || void 0,
       project: args.options?.mailProject || void 0

package/dist/production/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","ResponseError","ConfigurationQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAIC,SAAAA,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAOC,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAOI,WAAAA,oBAAoB,MAAM;AAAA,EAClC;AACD;;"}
+{"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t}, context.permissionContext.authorizator)\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","PersonQuery","ResponseError","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAIC,SAAAA,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAOF,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,GACZ,QAAQ,kBAAkB,YAAY;AACzC,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIG,SAAAA,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAOE,WAAAA,oBAAoB,MAAM;AAAA,EAClC;AACD;;"}

package/dist/production/src/resolvers/mutation/person/ResetPasswordMutationResolver.js

@@ -1,35 +1,57 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ResetPasswordMutationResolver {
-  constructor(passwordResetManager, permissionContextFactory) {
+  constructor(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter) {
     this.passwordResetManager = passwordResetManager;
     this.permissionContextFactory = permissionContextFactory;
+    this.captchaValidator = captchaValidator;
+    this.rateLimiter = rateLimiter;
   }
   async createResetPasswordRequest(parent, args, context, info) {
     await context.requireAccess({
       action: PermissionActions.PERSON_RESET_PASSWORD,
       message: "You are not allowed to initialize reset password request"
     });
+    const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers));
+    const rl = await this.rateLimiter.consume(context.db, "password_reset_per_ip", context.httpInfo.ip, configuration);
+    if (!rl.ok) {
+      return createErrorResponse("RATE_LIMIT_EXCEEDED", `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`);
+    }
+    const captchaConfig = this.captchaValidator.extractConfig(configuration);
+    if (this.captchaValidator.isEnabledFor(captchaConfig, "passwordReset")) {
+      const captcha = await this.captchaValidator.verify({
+        config: captchaConfig,
+        token: args.captchaToken ?? void 0,
+        remoteIp: context.httpInfo.ip
+      });
+      if (!captcha.ok) {
+        return createErrorResponse("INVALID_CAPTCHA", `Captcha verification failed: ${captcha.reason}`);
+      }
+    }
     const person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email));
     if (!person) {
       const responseError = new ResponseError("PERSON_NOT_FOUND", `Person with email ${args.email} was not found.`);
@@ -38,7 +60,6 @@ class ResetPasswordMutationResolver {
         response: responseError,
         personInput: args.email
       });
-      const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery());
       if (!configuration.login.revealUserExists) {
         return { ok: true, errors: [] };
       }
@@ -47,7 +68,7 @@ class ResetPasswordMutationResolver {
     const permissionContext = await this.permissionContextFactory.create(context.db, {
       id: person.identity_id,
       roles: person.roles
-    });
+    }, context.permissionContext.authorizator);
     await this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {
       mailVariant: args.options?.mailVariant || void 0,
       project: args.options?.mailProject || void 0

package/dist/production/src/resolvers/mutation/person/ResetPasswordMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'\nimport { createErrorResponse } from '../../errorUtils'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,YAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAClF,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}
+{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t}, context.permissionContext.authorizator)\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,GACZ,QAAQ,kBAAkB,YAAY;AACzC,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}

package/dist/production/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
+const ResetPersonMfaCommand = require("../../../model/commands/person/ResetPersonMfaCommand.cjs");
+require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class ResetPersonMfaMutationResolver {
+  constructor(personManager, backupCodeManager) {
+    this.personManager = personManager;
+    this.backupCodeManager = backupCodeManager;
+  }
+  async resetPersonMfa(parent, args, context) {
+    const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.PERSON_RESET_MFA(await TargetIdentityPermission.createPersonPermissionTarget(context.db, targetPerson)),
+      message: "You are not allowed to reset MFA for this person"
+    });
+    if (targetPerson === null) {
+      const response = new Response.ResponseError("PERSON_NOT_FOUND", `Person <${args.personId}> was not found`);
+      await context.logAuthAction({
+        type: "mfa_reset",
+        response,
+        metadata: { requestedPersonId: args.personId }
+      });
+      return errorUtils.createErrorResponse(response.error, response.errorMessage);
+    }
+    await context.db.commandBus.execute(new ResetPersonMfaCommand.ResetPersonMfaCommand(targetPerson.id));
+    await this.backupCodeManager.deleteForPerson(context.db, targetPerson.id);
+    await context.logAuthAction({
+      type: "mfa_reset",
+      response: new Response.ResponseOk(null),
+      targetPersonId: targetPerson.id
+    });
+    return { ok: true };
+  }
+}
+exports.ResetPersonMfaMutationResolver = ResetPersonMfaMutationResolver;
+//# sourceMappingURL=ResetPersonMfaMutationResolver.cjs.map

package/dist/production/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPersonMfaMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, createPersonPermissionTarget, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(await createPersonPermissionTarget(context.db, targetPerson)),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createPersonPermissionTarget","ResponseError","createErrorResponse","ResetPersonMfaCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,iBAAiB,MAAMC,yBAAAA,6BAA6B,QAAQ,IAAI,YAAY,CAAC;AAAA,MACvG,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}