@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RemoveProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import { MutationRemoveProjectMemberArgs, MutationResolvers, RemoveProjectMemberErrorCode, RemoveProjectMemberResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQD,kBAAAA,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"RemoveProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRemoveProjectMemberArgs,\n\tMutationResolvers,\n\tRemoveProjectMemberErrorCode,\n\tRemoveProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ProjectMembershipByIdentityQuery","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQD,kBAAAA,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/production/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.js

@@ -1,22 +1,28 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ProjectMembershipByIdentityQuery } from "../../../model/queries/membership/ProjectMembershipByIdentityQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
+import { logProjectMembershipChange } from "./audit.js";
 class RemoveProjectMemberMutationResolver {
   constructor(projectMemberManager, projectManager) {
     this.projectMemberManager = projectMemberManager;
@@ -44,10 +50,12 @@ class RemoveProjectMemberMutationResolver {
       action: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),
       message: "You are not allowed to remove a project member"
     });
+    const before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
     const result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId);
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
+    await logProjectMembershipChange(context, "project_membership_remove", project.id, identityId, before);
     return {
       ok: true,
       errors: []

package/dist/production/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"RemoveProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import { MutationRemoveProjectMemberArgs, MutationResolvers, RemoveProjectMemberErrorCode, RemoveProjectMemberResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAKO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"RemoveProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRemoveProjectMemberArgs,\n\tMutationResolvers,\n\tRemoveProjectMemberErrorCode,\n\tRemoveProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/production/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.cjs

@@ -2,25 +2,31 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ProjectMembershipByIdentityQuery = require("../../../model/queries/membership/ProjectMembershipByIdentityQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 const membershipUtils = require("../../../model/service/membershipUtils.cjs");
+require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+const schemaUtils = require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-const schemaUtils = require("@contember/schema-utils");
 require("otpauth");
 const membershipUtils$1 = require("../../membershipUtils.cjs");
 const errorUtils = require("../../errorUtils.cjs");
+const audit = require("./audit.cjs");
 class UpdateProjectMemberMutationResolver {
   constructor(projectMemberManager, projectManager, membershipValidator) {
     this.projectMemberManager = projectMemberManager;
@@ -68,10 +74,12 @@ class UpdateProjectMemberMutationResolver {
         error: errors[0]
       };
     }
+    const before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery.ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
     const result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch);
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
+    await audit.logProjectMembershipChange(context, "project_membership_update", project.id, identityId, before);
     return {
       ok: true,
       errors: []

package/dist/production/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateProjectMemberArgs, UpdateProjectMemberErrorCode, UpdateProjectMemberResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createMembershipModification } from '../../../model/service/membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { Acl } from '@contember/schema'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createMembershipModification","it","MembershipValidationErrorType","createMembershipValidationErrorResult","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkBC,gBAAAA,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAC,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQH,kBAAAA,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAUI,0CAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,kBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"UpdateProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationResolvers,\n\tMutationUpdateProjectMemberArgs,\n\tUpdateProjectMemberErrorCode,\n\tUpdateProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createMembershipModification } from '../../../model/service/membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Acl } from '@contember/schema'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createMembershipModification","it","MembershipValidationErrorType","createMembershipValidationErrorResult","ProjectMembershipByIdentityQuery","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkBC,gBAAAA,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAC,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQH,kBAAAA,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAUI,0CAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,kBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/production/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.js

@@ -1,24 +1,30 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ProjectMembershipByIdentityQuery } from "../../../model/queries/membership/ProjectMembershipByIdentityQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import { createMembershipModification } from "../../../model/service/membershipUtils.js";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import { MembershipValidationErrorType } from "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import { MembershipValidationErrorType } from "@contember/schema-utils";
 import "otpauth";
 import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
+import { logProjectMembershipChange } from "./audit.js";
 class UpdateProjectMemberMutationResolver {
   constructor(projectMemberManager, projectManager, membershipValidator) {
     this.projectMemberManager = projectMemberManager;
@@ -66,10 +72,12 @@ class UpdateProjectMemberMutationResolver {
         error: errors[0]
       };
     }
+    const before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
     const result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch);
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
+    await logProjectMembershipChange(context, "project_membership_update", project.id, identityId, before);
     return {
       ok: true,
       errors: []

package/dist/production/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateProjectMemberArgs, UpdateProjectMemberErrorCode, UpdateProjectMemberResponse } from '../../../schema'\nimport { TenantResolverContext } from '../../TenantResolverContext'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils'\nimport { createMembershipModification } from '../../../model/service/membershipUtils'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'\nimport { Acl } from '@contember/schema'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["it"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkB,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAU,8BAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"UpdateProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationResolvers,\n\tMutationUpdateProjectMemberArgs,\n\tUpdateProjectMemberErrorCode,\n\tUpdateProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createMembershipModification } from '../../../model/service/membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Acl } from '@contember/schema'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["it"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkB,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAU,8BAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/production/src/resolvers/mutation/projectMember/audit.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ProjectMembershipByIdentityQuery = require("../../../model/queries/membership/ProjectMembershipByIdentityQuery.cjs");
+const PersonByIdentityBatchQuery = require("../../../model/queries/person/PersonByIdentityBatchQuery.cjs");
+require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+const Response = require("../../../model/utils/Response.cjs");
+const logProjectMembershipChange = async (context, auditType, projectId, identityId, before) => {
+  const after = auditType === "project_membership_remove" ? [] : await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery.ProjectMembershipByIdentityQuery({ id: projectId }, [identityId]));
+  const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery.PersonByIdentityBatchQuery([identityId]));
+  await context.logAuthAction({
+    type: auditType,
+    response: new Response.ResponseOk(null),
+    targetPersonId: targetPerson?.id,
+    eventData: {
+      projectId,
+      identityId,
+      before: before.map(membershipToJson),
+      after: after.map(membershipToJson)
+    }
+  });
+};
+const membershipToJson = ({ role, variables }) => ({
+  role,
+  variables: variables.map(({ name, values }) => ({ name, values: [...values] }))
+});
+exports.logProjectMembershipChange = logProjectMembershipChange;
+//# sourceMappingURL=audit.cjs.map

package/dist/production/src/resolvers/mutation/projectMember/audit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/audit.ts"],"sourcesContent":["import { Acl, JSONValue } from '@contember/schema'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { AuthActionType } from '../../../model/type/AuthLog.js'\n\nexport const logProjectMembershipChange = async (\n\tcontext: TenantResolverContext,\n\tauditType: Extract<AuthActionType, 'project_membership_create' | 'project_membership_update' | 'project_membership_remove'>,\n\tprojectId: string,\n\tidentityId: string,\n\tbefore: readonly Acl.Membership[],\n): Promise<void> => {\n\tconst after = auditType === 'project_membership_remove'\n\t\t? []\n\t\t: await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: projectId }, [identityId]))\n\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\tawait context.logAuthAction({\n\t\ttype: auditType,\n\t\tresponse: new ResponseOk(null),\n\t\ttargetPersonId: targetPerson?.id,\n\t\teventData: {\n\t\t\tprojectId,\n\t\t\tidentityId,\n\t\t\tbefore: before.map(membershipToJson),\n\t\t\tafter: after.map(membershipToJson),\n\t\t},\n\t})\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":["ProjectMembershipByIdentityQuery","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;AAOO,MAAM,6BAA6B,OACzC,SACA,WACA,WACA,YACA,WACmB;AACnB,QAAM,QAAQ,cAAc,8BACzB,CAAA,IACA,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIA,iCAAAA,iCAAiC,EAAE,IAAI,UAAA,GAAa,CAAC,UAAU,CAAC,CAAC;AAC5G,QAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,QAAM,QAAQ,cAAc;AAAA,IAC3B,MAAM;AAAA,IACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC7B,gBAAgB,cAAc;AAAA,IAC9B,WAAW;AAAA,MACV;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,IAAI,gBAAgB;AAAA,MACnC,OAAO,MAAM,IAAI,gBAAgB;AAAA,IAAA;AAAA,EAClC,CACA;AACF;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;;"}

package/dist/production/src/resolvers/mutation/projectMember/audit.js

@@ -0,0 +1,35 @@
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ProjectMembershipByIdentityQuery } from "../../../model/queries/membership/ProjectMembershipByIdentityQuery.js";
+import { PersonByIdentityBatchQuery } from "../../../model/queries/person/PersonByIdentityBatchQuery.js";
+import "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/authorization/CustomRolePermissions.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import { ResponseOk } from "../../../model/utils/Response.js";
+const logProjectMembershipChange = async (context, auditType, projectId, identityId, before) => {
+  const after = auditType === "project_membership_remove" ? [] : await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: projectId }, [identityId]));
+  const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]));
+  await context.logAuthAction({
+    type: auditType,
+    response: new ResponseOk(null),
+    targetPersonId: targetPerson?.id,
+    eventData: {
+      projectId,
+      identityId,
+      before: before.map(membershipToJson),
+      after: after.map(membershipToJson)
+    }
+  });
+};
+const membershipToJson = ({ role, variables }) => ({
+  role,
+  variables: variables.map(({ name, values }) => ({ name, values: [...values] }))
+});
+export {
+  logProjectMembershipChange
+};
+//# sourceMappingURL=audit.js.map

package/dist/production/src/resolvers/mutation/projectMember/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/audit.ts"],"sourcesContent":["import { Acl, JSONValue } from '@contember/schema'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { AuthActionType } from '../../../model/type/AuthLog.js'\n\nexport const logProjectMembershipChange = async (\n\tcontext: TenantResolverContext,\n\tauditType: Extract<AuthActionType, 'project_membership_create' | 'project_membership_update' | 'project_membership_remove'>,\n\tprojectId: string,\n\tidentityId: string,\n\tbefore: readonly Acl.Membership[],\n): Promise<void> => {\n\tconst after = auditType === 'project_membership_remove'\n\t\t? []\n\t\t: await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: projectId }, [identityId]))\n\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\tawait context.logAuthAction({\n\t\ttype: auditType,\n\t\tresponse: new ResponseOk(null),\n\t\ttargetPersonId: targetPerson?.id,\n\t\teventData: {\n\t\t\tprojectId,\n\t\t\tidentityId,\n\t\t\tbefore: before.map(membershipToJson),\n\t\t\tafter: after.map(membershipToJson),\n\t\t},\n\t})\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":[],"mappings":";;;;;;;;;;;;AAOO,MAAM,6BAA6B,OACzC,SACA,WACA,WACA,YACA,WACmB;AACnB,QAAM,QAAQ,cAAc,8BACzB,CAAA,IACA,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,UAAA,GAAa,CAAC,UAAU,CAAC,CAAC;AAC5G,QAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,QAAM,QAAQ,cAAc;AAAA,IAC3B,MAAM;AAAA,IACN,UAAU,IAAI,WAAW,IAAI;AAAA,IAC7B,gBAAgB,cAAc;AAAA,IAC9B,WAAW;AAAA,MACV;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,IAAI,gBAAgB;AAAA,MACnC,OAAO,MAAM,IAAI,gBAAgB;AAAA,IAAA;AAAA,EAClC,CACA;AACF;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;"}

package/dist/production/src/resolvers/query/ApiKeyQueryResolver.cjs

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ApiKeyListQuery = require("../../model/queries/apiKey/ApiKeyListQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+require("otpauth");
+const ApiKeyResponseFactory = require("../responseHelpers/ApiKeyResponseFactory.cjs");
+class ApiKeyQueryResolver {
+  async globalApiKeys(parent, args, context) {
+    if (!await context.isAllowed({ action: PermissionActions.PermissionActions.API_KEY_LIST })) {
+      return [];
+    }
+    const rows = await context.db.queryHandler.fetch(new ApiKeyListQuery.GlobalApiKeysQuery());
+    return rows.map((row) => ApiKeyResponseFactory.ApiKeyResponseFactory.createApiKeyResponse(row));
+  }
+}
+exports.ApiKeyQueryResolver = ApiKeyQueryResolver;
+//# sourceMappingURL=ApiKeyQueryResolver.cjs.map

package/dist/production/src/resolvers/query/ApiKeyQueryResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ApiKeyQueryResolver.ts"],"sourcesContent":["import { ApiKey, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ApiKeyQueryResolver implements QueryResolvers {\n\tasync globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {\n\t\tif (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n}\n"],"names":["PermissionActions","GlobalApiKeysQuery","ApiKeyResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,oBAA8C;AAAA,EAC1D,MAAM,cAAc,QAAiB,MAAe,SAA4D;AAC/G,QAAI,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAA,CAAc,GAAI;AAC3E,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB;AACzE,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}

package/dist/production/src/resolvers/query/ApiKeyQueryResolver.js

@@ -0,0 +1,37 @@
+import { PermissionActions } from "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import { GlobalApiKeysQuery } from "../../model/queries/apiKey/ApiKeyListQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import "otpauth";
+import { ApiKeyResponseFactory } from "../responseHelpers/ApiKeyResponseFactory.js";
+class ApiKeyQueryResolver {
+  async globalApiKeys(parent, args, context) {
+    if (!await context.isAllowed({ action: PermissionActions.API_KEY_LIST })) {
+      return [];
+    }
+    const rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery());
+    return rows.map((row) => ApiKeyResponseFactory.createApiKeyResponse(row));
+  }
+}
+export {
+  ApiKeyQueryResolver
+};
+//# sourceMappingURL=ApiKeyQueryResolver.js.map

package/dist/production/src/resolvers/query/ApiKeyQueryResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ApiKeyQueryResolver.ts"],"sourcesContent":["import { ApiKey, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ApiKeyQueryResolver implements QueryResolvers {\n\tasync globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {\n\t\tif (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,oBAA8C;AAAA,EAC1D,MAAM,cAAc,QAAiB,MAAe,SAA4D;AAC/G,QAAI,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,aAAA,CAAc,GAAI;AAC3E,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AACzE,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}

package/dist/production/src/resolvers/query/AuthLogQueryResolver.cjs

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+require("otpauth");
+const AuthLogQuery = require("../../model/queries/authLog/AuthLogQuery.cjs");
+class AuthLogQueryResolver {
+  async authLog(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.AUTH_LOG_VIEW,
+      message: "You are not allowed to view the audit log"
+    });
+    const limit = args.limit ?? void 0;
+    const offset = args.offset ?? void 0;
+    const filter = args.filter ?? {};
+    const rows = await context.db.queryHandler.fetch(
+      new AuthLogQuery.AuthLogQuery(
+        {
+          types: filter.types ?? void 0,
+          success: filter.success ?? void 0,
+          invokedByIdentityId: filter.invokedByIdentityId ?? void 0,
+          personId: filter.personId ?? void 0,
+          targetPersonId: filter.targetPersonId ?? void 0,
+          personInputIdentifier: filter.personInputIdentifier ?? void 0,
+          createdAfter: filter.createdAfter ?? void 0,
+          createdBefore: filter.createdBefore ?? void 0
+        },
+        { limit: limit ?? void 0, offset: offset ?? void 0 }
+      )
+    );
+    const effectiveLimit = Math.min(limit ?? AuthLogQuery.AuthLogQuery.defaultLimit, AuthLogQuery.AuthLogQuery.hardLimit);
+    const hasMore = rows.length > effectiveLimit;
+    const visible = hasMore ? rows.slice(0, effectiveLimit) : rows;
+    return {
+      hasMore,
+      entries: visible.map((row) => ({
+        id: row.id,
+        createdAt: row.created_at,
+        type: row.type,
+        success: row.success,
+        invokedByIdentityId: row.invoked_by_id,
+        personId: row.person_id,
+        targetPersonId: row.target_person_id,
+        personInputIdentifier: row.person_input_identifier,
+        errorCode: row.error_code,
+        errorMessage: row.error_message,
+        ipAddress: row.ip_address,
+        userAgent: row.user_agent,
+        identityProviderId: row.identity_provider_id,
+        metadata: row.metadata,
+        eventData: row.event_data
+      }))
+    };
+  }
+}
+exports.AuthLogQueryResolver = AuthLogQueryResolver;
+//# sourceMappingURL=AuthLogQueryResolver.cjs.map

package/dist/production/src/resolvers/query/AuthLogQueryResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthLogQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthLogQueryResolver.ts"],"sourcesContent":["import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'\nimport { AuthActionType } from '../../model/type/AuthLog.js'\n\nexport class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {\n\tasync authLog(\n\t\tparent: unknown,\n\t\targs: QueryAuthLogArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AuthLogPage> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.AUTH_LOG_VIEW,\n\t\t\tmessage: 'You are not allowed to view the audit log',\n\t\t})\n\n\t\tconst limit = args.limit ?? undefined\n\t\tconst offset = args.offset ?? undefined\n\t\tconst filter = args.filter ?? {}\n\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew AuthLogQuery(\n\t\t\t\t{\n\t\t\t\t\ttypes: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,\n\t\t\t\t\tsuccess: filter.success ?? undefined,\n\t\t\t\t\tinvokedByIdentityId: filter.invokedByIdentityId ?? undefined,\n\t\t\t\t\tpersonId: filter.personId ?? undefined,\n\t\t\t\t\ttargetPersonId: filter.targetPersonId ?? undefined,\n\t\t\t\t\tpersonInputIdentifier: filter.personInputIdentifier ?? undefined,\n\t\t\t\t\tcreatedAfter: filter.createdAfter ?? undefined,\n\t\t\t\t\tcreatedBefore: filter.createdBefore ?? undefined,\n\t\t\t\t},\n\t\t\t\t{ limit: limit ?? undefined, offset: offset ?? undefined },\n\t\t\t),\n\t\t)\n\n\t\tconst effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)\n\t\tconst hasMore = rows.length > effectiveLimit\n\t\tconst visible = hasMore ? rows.slice(0, effectiveLimit) : rows\n\n\t\treturn {\n\t\t\thasMore,\n\t\t\tentries: visible.map(row => ({\n\t\t\t\tid: row.id,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\ttype: row.type,\n\t\t\t\tsuccess: row.success,\n\t\t\t\tinvokedByIdentityId: row.invoked_by_id,\n\t\t\t\tpersonId: row.person_id,\n\t\t\t\ttargetPersonId: row.target_person_id,\n\t\t\t\tpersonInputIdentifier: row.person_input_identifier,\n\t\t\t\terrorCode: row.error_code,\n\t\t\t\terrorMessage: row.error_message,\n\t\t\t\tipAddress: row.ip_address,\n\t\t\t\tuserAgent: row.user_agent,\n\t\t\t\tidentityProviderId: row.identity_provider_id,\n\t\t\t\tmetadata: row.metadata,\n\t\t\t\teventData: row.event_data,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","AuthLogQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,qBAAgE;AAAA,EAC5E,MAAM,QACL,QACA,MACA,SACuB;AACvB,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,SAAS,KAAK,UAAU,CAAA;AAE9B,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,aAAAA;AAAAA,QACH;AAAA,UACC,OAAQ,OAAO,SAAS;AAAA,UACxB,SAAS,OAAO,WAAW;AAAA,UAC3B,qBAAqB,OAAO,uBAAuB;AAAA,UACnD,UAAU,OAAO,YAAY;AAAA,UAC7B,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,uBAAuB,OAAO,yBAAyB;AAAA,UACvD,cAAc,OAAO,gBAAgB;AAAA,UACrC,eAAe,OAAO,iBAAiB;AAAA,QAAA;AAAA,QAExC,EAAE,OAAO,SAAS,QAAW,QAAQ,UAAU,OAAA;AAAA,MAAU;AAAA,IAC1D;AAGD,UAAM,iBAAiB,KAAK,IAAI,SAASA,aAAAA,aAAa,cAAcA,aAAAA,aAAa,SAAS;AAC1F,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,UAAU,KAAK,MAAM,GAAG,cAAc,IAAI;AAE1D,WAAO;AAAA,MACN;AAAA,MACA,SAAS,QAAQ,IAAI,CAAA,SAAQ;AAAA,QAC5B,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,qBAAqB,IAAI;AAAA,QACzB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,uBAAuB,IAAI;AAAA,QAC3B,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,MAAA,EACd;AAAA,IAAA;AAAA,EAEJ;AACD;;"}

package/dist/production/src/resolvers/query/AuthLogQueryResolver.js

@@ -0,0 +1,76 @@
+import { PermissionActions } from "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import "otpauth";
+import { AuthLogQuery } from "../../model/queries/authLog/AuthLogQuery.js";
+class AuthLogQueryResolver {
+  async authLog(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.AUTH_LOG_VIEW,
+      message: "You are not allowed to view the audit log"
+    });
+    const limit = args.limit ?? void 0;
+    const offset = args.offset ?? void 0;
+    const filter = args.filter ?? {};
+    const rows = await context.db.queryHandler.fetch(
+      new AuthLogQuery(
+        {
+          types: filter.types ?? void 0,
+          success: filter.success ?? void 0,
+          invokedByIdentityId: filter.invokedByIdentityId ?? void 0,
+          personId: filter.personId ?? void 0,
+          targetPersonId: filter.targetPersonId ?? void 0,
+          personInputIdentifier: filter.personInputIdentifier ?? void 0,
+          createdAfter: filter.createdAfter ?? void 0,
+          createdBefore: filter.createdBefore ?? void 0
+        },
+        { limit: limit ?? void 0, offset: offset ?? void 0 }
+      )
+    );
+    const effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit);
+    const hasMore = rows.length > effectiveLimit;
+    const visible = hasMore ? rows.slice(0, effectiveLimit) : rows;
+    return {
+      hasMore,
+      entries: visible.map((row) => ({
+        id: row.id,
+        createdAt: row.created_at,
+        type: row.type,
+        success: row.success,
+        invokedByIdentityId: row.invoked_by_id,
+        personId: row.person_id,
+        targetPersonId: row.target_person_id,
+        personInputIdentifier: row.person_input_identifier,
+        errorCode: row.error_code,
+        errorMessage: row.error_message,
+        ipAddress: row.ip_address,
+        userAgent: row.user_agent,
+        identityProviderId: row.identity_provider_id,
+        metadata: row.metadata,
+        eventData: row.event_data
+      }))
+    };
+  }
+}
+export {
+  AuthLogQueryResolver
+};
+//# sourceMappingURL=AuthLogQueryResolver.js.map

package/dist/production/src/resolvers/query/AuthLogQueryResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthLogQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthLogQueryResolver.ts"],"sourcesContent":["import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'\nimport { AuthActionType } from '../../model/type/AuthLog.js'\n\nexport class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {\n\tasync authLog(\n\t\tparent: unknown,\n\t\targs: QueryAuthLogArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AuthLogPage> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.AUTH_LOG_VIEW,\n\t\t\tmessage: 'You are not allowed to view the audit log',\n\t\t})\n\n\t\tconst limit = args.limit ?? undefined\n\t\tconst offset = args.offset ?? undefined\n\t\tconst filter = args.filter ?? {}\n\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew AuthLogQuery(\n\t\t\t\t{\n\t\t\t\t\ttypes: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,\n\t\t\t\t\tsuccess: filter.success ?? undefined,\n\t\t\t\t\tinvokedByIdentityId: filter.invokedByIdentityId ?? undefined,\n\t\t\t\t\tpersonId: filter.personId ?? undefined,\n\t\t\t\t\ttargetPersonId: filter.targetPersonId ?? undefined,\n\t\t\t\t\tpersonInputIdentifier: filter.personInputIdentifier ?? undefined,\n\t\t\t\t\tcreatedAfter: filter.createdAfter ?? undefined,\n\t\t\t\t\tcreatedBefore: filter.createdBefore ?? undefined,\n\t\t\t\t},\n\t\t\t\t{ limit: limit ?? undefined, offset: offset ?? undefined },\n\t\t\t),\n\t\t)\n\n\t\tconst effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)\n\t\tconst hasMore = rows.length > effectiveLimit\n\t\tconst visible = hasMore ? rows.slice(0, effectiveLimit) : rows\n\n\t\treturn {\n\t\t\thasMore,\n\t\t\tentries: visible.map(row => ({\n\t\t\t\tid: row.id,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\ttype: row.type,\n\t\t\t\tsuccess: row.success,\n\t\t\t\tinvokedByIdentityId: row.invoked_by_id,\n\t\t\t\tpersonId: row.person_id,\n\t\t\t\ttargetPersonId: row.target_person_id,\n\t\t\t\tpersonInputIdentifier: row.person_input_identifier,\n\t\t\t\terrorCode: row.error_code,\n\t\t\t\terrorMessage: row.error_message,\n\t\t\t\tipAddress: row.ip_address,\n\t\t\t\tuserAgent: row.user_agent,\n\t\t\t\tidentityProviderId: row.identity_provider_id,\n\t\t\t\tmetadata: row.metadata,\n\t\t\t\teventData: row.event_data,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,qBAAgE;AAAA,EAC5E,MAAM,QACL,QACA,MACA,SACuB;AACvB,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,SAAS,KAAK,UAAU,CAAA;AAE9B,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI;AAAA,QACH;AAAA,UACC,OAAQ,OAAO,SAAS;AAAA,UACxB,SAAS,OAAO,WAAW;AAAA,UAC3B,qBAAqB,OAAO,uBAAuB;AAAA,UACnD,UAAU,OAAO,YAAY;AAAA,UAC7B,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,uBAAuB,OAAO,yBAAyB;AAAA,UACvD,cAAc,OAAO,gBAAgB;AAAA,UACrC,eAAe,OAAO,iBAAiB;AAAA,QAAA;AAAA,QAExC,EAAE,OAAO,SAAS,QAAW,QAAQ,UAAU,OAAA;AAAA,MAAU;AAAA,IAC1D;AAGD,UAAM,iBAAiB,KAAK,IAAI,SAAS,aAAa,cAAc,aAAa,SAAS;AAC1F,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,UAAU,KAAK,MAAM,GAAG,cAAc,IAAI;AAE1D,WAAO;AAAA,MACN;AAAA,MACA,SAAS,QAAQ,IAAI,CAAA,SAAQ;AAAA,QAC5B,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,qBAAqB,IAAI;AAAA,QACzB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,uBAAuB,IAAI;AAAA,QAC3B,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,MAAA,EACd;AAAA,IAAA;AAAA,EAEJ;AACD;"}