@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/type/RateLimit.d.ts

@@ -0,0 +1,10 @@
+export declare const RateLimitScopes: {
+    readonly signUpPerIp: 'sign_up_per_ip';
+    readonly loginPerIp: 'login_per_ip';
+    readonly passwordResetPerIp: 'password_reset_per_ip';
+    readonly passwordlessInitPerIp: 'passwordless_init_per_ip';
+    readonly emailOtpPerPerson: 'email_otp_per_person';
+    readonly emailVerificationPerIp: 'email_verification_per_ip';
+};
+export type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes];
+//# sourceMappingURL=RateLimit.d.ts.map

package/dist/types/model/type/RateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../../../src/model/type/RateLimit.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;aAC3B,WAAW,EAAE,gBAAgB;aAC7B,UAAU,EAAE,cAAc;aAC1B,kBAAkB,EAAE,uBAAuB;aAC3C,qBAAqB,EAAE,0BAA0B;aACjD,iBAAiB,EAAE,sBAAsB;aACzC,sBAAsB,EAAE,2BAA2B;CAC1C,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}

package/dist/types/model/type/index.d.ts

@@ -1,6 +1,9 @@
-export * from './ApiKey';
-export * from './IdentityProvider';
-export * from './Project';
-export * from './Variables';
-export * from './PersonToken';
+export * from './ApiKey.js';
+export * from './AuthPolicy.js';
+export * from './Config.js';
+export * from './CustomRole.js';
+export * from './IdentityProvider.js';
+export * from './Project.js';
+export * from './Variables.js';
+export * from './PersonToken.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/type/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,oBAAoB,CAAA;AAClC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA"}

package/dist/types/model/utils/DatabaseContext.d.ts

@@ -1,8 +1,8 @@
 import { Client, Connection } from '@contember/database';
 import { Logger } from '@contember/logger';
-import { Providers } from '../providers';
-import { CommandBus } from '../commands';
-import { BatchLoaderArgs } from '../../utils/batchQuery';
+import { Providers } from '../providers.js';
+import { CommandBus } from '../commands/index.js';
+import { BatchLoaderArgs } from '../../utils/batchQuery.js';
 export interface TransactionOptions {
     /**
      * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the
@@ -14,6 +14,7 @@ export interface TransactionOptions {
     retry?: {
         logger: Logger;
     };
+    readonly isolation?: 'repeatableRead' | 'readCommitted';
 }
 export declare class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
     readonly client: Client<Conn>;

package/dist/types/model/utils/DatabaseContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAA+B,MAAM,wBAAwB,CAAA;AAErF,MAAM,WAAW,kBAAkB;IAClC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1B;AAED,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;gBAGhE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS;IAIrC,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EACzB,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1E,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,CAAC,CAAC;IAaA,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAM7G,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAS5G"}
+{"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,2BAA2B,CAAA;AAExF,MAAM,WAAW,kBAAkB;IAClC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAA;CACvD;AAED,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;IAEjF,YACiB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS,EAEpC;IAED,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EACzB,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1E,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAaZ;IAEY,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAInH;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3G;CACD"}

package/dist/types/model/utils/Response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Response.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/Response.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,IACjF,UAAU,CAAC,MAAM,CAAC,GAClB,CAAC,KAAK,SAAS,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAA;AAEtE,qBAAa,UAAU,CAAC,MAAM;aAGD,MAAM,EAAE,MAAM;IAF1C,SAAgB,EAAE,QAAO;gBAEG,MAAM,EAAE,MAAM;CAC1C;AAED,qBAAa,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS;aAIjE,KAAK,EAAE,KAAK;aACZ,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,QAAQ;IALpC,SAAgB,EAAE,SAAQ;gBAGT,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,QAAQ,YAAA;CAEpC"}
+{"version":3,"file":"Response.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/Response.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,IACjF,UAAU,CAAC,MAAM,CAAC,GAClB,CAAC,KAAK,SAAS,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAA;AAEtE,qBAAa,UAAU,CAAC,MAAM;aAGD,MAAM,EAAE,MAAM;IAF1C,SAAgB,EAAE,QAAO;IAEzB,YAA4B,MAAM,EAAE,MAAM,EAAI;CAC9C;AAED,qBAAa,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS;aAIjE,KAAK,EAAE,KAAK;aACZ,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,QAAQ;IALpC,SAAgB,EAAE,SAAQ;IAE1B,YACiB,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAChC;CACJ"}

package/dist/types/model/utils/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/email.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,WAE3C,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,OAI7C,CAAA"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/email.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,UAAW,MAAM,WAE3C,CAAA;AAED,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,OAI7C,CAAA"}

package/dist/types/model/utils/hex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/hex.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,OAAO,EAAE,aAAa,MAAM,EAAE,CAAA;CAAE,CAAA;AAIrG,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,MAAM,EAAE,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAG,KAAK,IAAI,oBAAoB,CAAC,MAAM,CAEjI,CAAA"}
+{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/hex.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,OAAO,EAAE,aAAa,MAAM,EAAE,CAAA;CAAE,CAAA;AAIrG,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,KAAK,IAAI,oBAAoB,CAAC,MAAM,CAEjI,CAAA"}

package/dist/types/model/utils/index.d.ts

@@ -1,3 +1,3 @@
-export * from './DatabaseContext';
-export * from './token';
+export * from './DatabaseContext.js';
+export * from './token.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA"}

package/dist/types/model/utils/interval.d.ts

@@ -1,3 +1,9 @@
 import { IPostgresInterval } from 'postgres-interval';
+/**
+ * Serializes an interval into a Postgres-acceptable string literal for use as a
+ * query parameter (e.g. writing into an INTERVAL column). `postgres-interval`
+ * instances expose `toPostgres()`; we fall back to a seconds literal otherwise.
+ */
+export declare const intervalToPostgres: (interval: IPostgresInterval) => string;
 export declare const intervalToSeconds: (interval: IPostgresInterval) => number;
 //# sourceMappingURL=interval.d.ts.map

package/dist/types/model/utils/interval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interval.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/interval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,eAAO,MAAM,iBAAiB,GAAI,UAAU,iBAAiB,KAAG,MAW/D,CAAA"}
+{"version":3,"file":"interval.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/interval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,iBAAiB,KAAG,MAKhE,CAAA;AAED,eAAO,MAAM,iBAAiB,aAAc,iBAAiB,KAAG,MAW/D,CAAA"}

package/dist/types/model/utils/time.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/time.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,GAAI,KAAK,IAAI,EAAE,MAAM,MAAM,SAA4C,CAAA"}
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/time.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,QAAS,IAAI,QAAQ,MAAM,SAA4C,CAAA"}

package/dist/types/model/utils/token.d.ts

@@ -1,16 +1,22 @@
-import { FixedLengthHexString } from './hex';
-import { PersonToken } from '../type';
-import { Response } from './Response';
+import { FixedLengthHexString } from './hex.js';
+import { PersonToken } from '../type/index.js';
+import { Response } from './Response.js';
 export declare const generateToken: (generator: {
     randomBytes: (bytes: number) => Promise<Buffer>;
 }) => Promise<string>;
 export type TokenHash = FixedLengthHexString<64>;
 export declare const computeTokenHash: (token: string) => TokenHash;
 export declare const isTokenHash: (token: string) => token is TokenHash;
-export declare const validateToken: ({ entry, validationType, token, now }: {
+export declare const MAX_OTP_ATTEMPTS = 3;
+/**
+ * Constant-time comparison of two token hashes. Both inputs are expected to be
+ * 64-character hex strings (sha256). Returns false on any length mismatch
+ * without leaking timing information about the matching prefix.
+ */
+export declare const timingSafeCompareHash: (a: TokenHash, b: TokenHash) => boolean;
+export declare const validateToken: ({ entry, validationType, token }: {
     entry: PersonToken.Row | null;
     validationType: PersonToken.ValidationType;
     token: string;
-    now: Date;
 }) => Response<PersonToken.Row, PersonToken.TokenValidationError>;
 //# sourceMappingURL=token.d.ts.map

package/dist/types/model/utils/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,OAAO,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAErC,OAAO,EAAE,QAAQ,EAA6B,MAAM,YAAY,CAAA;AAEhE,eAAO,MAAM,aAAa,GAAU,WAAW;IAC9C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,KAAG,OAAO,CAAC,MAAM,CAEjB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;AAEhD,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,SAKhD,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,SAA8C,CAAA;AAInG,eAAO,MAAM,aAAa,GAAI,uCAAuC;IACpE,KAAK,EAAE,WAAW,CAAC,GAAG,GAAG,IAAI,CAAA;IAC7B,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,IAAI,CAAA;CACT,KAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,CAkC7D,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,QAAQ,EAA6B,MAAM,eAAe,CAAA;AAEnE,eAAO,MAAM,aAAa,cAAqB;IAC9C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,KAAG,OAAO,CAAC,MAAM,CAEjB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;AAEhD,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,SAKhD,CAAA;AAED,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,KAAK,IAAI,SAA8C,CAAA;AAEnG,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,MAAO,SAAS,KAAK,SAAS,KAAG,OAOlE,CAAA;AAED,eAAO,MAAM,aAAa,qCAAsC;IAC/D,KAAK,EAAE,WAAW,CAAC,GAAG,GAAG,IAAI,CAAA;IAC7B,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;CACb,KAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,CAkC7D,CAAA"}

package/dist/types/resolvers/Resolver.d.ts

@@ -1,4 +1,4 @@
-import * as Schema from '../schema';
+import * as Schema from '../schema/index.js';
 import { IResolvers } from '@graphql-tools/utils';
 export interface IgnoreIndex {
     [key: string]: any;

package/dist/types/resolvers/Resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Resolver.d.ts","sourceRoot":"","sources":["../../../src/resolvers/Resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,MAAM,WAAW,WAAW;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC3C,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,WAAW,CAAA;IAC1C,QAAQ,EAAE,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAA;CAChD"}
+{"version":3,"file":"Resolver.d.ts","sourceRoot":"","sources":["../../../src/resolvers/Resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,MAAM,WAAW,WAAW;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC3C,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,WAAW,CAAA;IAC1C,QAAQ,EAAE,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAA;CAChD"}

package/dist/types/resolvers/ResolverFactory.d.ts

@@ -1,15 +1,25 @@
-import { AddIDPMutationResolver, AddProjectMemberMutationResolver, ChangePasswordMutationResolver, ChangeProfileMutationResolver, CreateApiKeyMutationResolver, CreateProjectMutationResolver, DisableApiKeyMutationResolver, DisableIDPMutationResolver, EnableIDPMutationResolver, IdentityGlobalRolesMutationResolver, IDPMutationResolver, InviteMutationResolver, MailTemplateMutationResolver, OtpMutationResolver, RemoveProjectMemberMutationResolver, ResetPasswordMutationResolver, SetProjectSecretMutationResolver, SignInMutationResolver, SignOutMutationResolver, SignUpMutationResolver, UpdateProjectMemberMutationResolver, UpdateProjectMutationResolver } from './mutation';
-import { Resolvers } from '../schema';
-import { MeQueryResolver, PersonQueryResolver, ProjectMembersQueryResolver, ProjectQueryResolver } from './query';
-import { IdentityTypeResolver, ProjectTypeResolver } from './types';
-import { IDPQueryResolver } from './query/IDPQueryResolver';
-import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver';
-import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver';
-import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver';
-import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver';
-import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver';
-import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver';
-import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver';
+import { AddIDPMutationResolver, AddProjectMemberMutationResolver, ChangePasswordMutationResolver, ChangeProfileMutationResolver, CreateApiKeyMutationResolver, CreateProjectMutationResolver, DisableApiKeyMutationResolver, DisableIDPMutationResolver, EmailOtpMutationResolver, EnableIDPMutationResolver, IdentityGlobalRolesMutationResolver, IDPMutationResolver, InviteMutationResolver, MailTemplateMutationResolver, OtpMutationResolver, RegenerateBackupCodesMutationResolver, RemoveProjectMemberMutationResolver, ResetPasswordMutationResolver, SetProjectSecretMutationResolver, SignInMutationResolver, SignOutMutationResolver, SignUpMutationResolver, UpdateProjectMemberMutationResolver, UpdateProjectMutationResolver } from './mutation/index.js';
+import { Resolvers } from '../schema/index.js';
+import { ApiKeyQueryResolver, AuthLogQueryResolver, MeQueryResolver, PersonQueryResolver, ProjectMembersQueryResolver, ProjectQueryResolver } from './query/index.js';
+import { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js';
+import { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js';
+import { IDPQueryResolver } from './query/IDPQueryResolver.js';
+import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js';
+import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js';
+import { EnablePersonMutationResolver } from './mutation/person/EnablePersonMutationResolver.js';
+import { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js';
+import { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js';
+import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js';
+import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js';
+import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js';
+import { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js';
+import { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js';
+import { CustomRoleMutationResolver } from './mutation/customRole/CustomRoleMutationResolver.js';
+import { CustomRoleQueryResolver } from './query/CustomRoleQueryResolver.js';
+import { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js';
+import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js';
+import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js';
+import { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js';
 declare class ResolverFactory {
     private readonly resolvers;
     constructor(resolvers: {
@@ -25,13 +35,19 @@ declare class ResolverFactory {
         changeProfileMutationResolver: ChangeProfileMutationResolver;
         changePasswordMutationResolver: ChangePasswordMutationResolver;
         resetPasswordMutationResolver: ResetPasswordMutationResolver;
+        emailVerificationMutationResolver: EmailVerificationMutationResolver;
         idpMutationResolver: IDPMutationResolver;
         registerIdpMutationResolver: AddIDPMutationResolver;
         disableIdpMutationResolver: DisableIDPMutationResolver;
         enableIdpMutationResolver: EnableIDPMutationResolver;
         updateIdpMutationResolver: UpdateIDPMutationResolver;
+        disconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver;
         passwordlessMutationResolver: PasswordlessMutationResolver;
         disablePersonMutationResolver: DisablePersonMutationResolver;
+        enablePersonMutationResolver: EnablePersonMutationResolver;
+        forceSignOutMutationResolver: ForceSignOutMutationResolver;
+        resetPersonMfaMutationResolver: ResetPersonMfaMutationResolver;
+        revokeSessionMutationResolver: RevokeSessionMutationResolver;
         inviteMutationResolver: InviteMutationResolver;
         addProjectMemberMutationResolver: AddProjectMemberMutationResolver;
         updateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver;
@@ -39,15 +55,24 @@ declare class ResolverFactory {
         createApiKeyMutationResolver: CreateApiKeyMutationResolver;
         disableApiKeyMutationResolver: DisableApiKeyMutationResolver;
         otpMutationResolver: OtpMutationResolver;
+        emailOtpMutationResolver: EmailOtpMutationResolver;
+        regenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver;
         mailTemplateMutationResolver: MailTemplateMutationResolver;
         createProjectMutationResolver: CreateProjectMutationResolver;
         setProjectSecretMutationResolver: SetProjectSecretMutationResolver;
         updateProjectMutationResolver: UpdateProjectMutationResolver;
         identityTypeResolver: IdentityTypeResolver;
+        personTypeResolver: PersonTypeResolver;
         projectTypeResolver: ProjectTypeResolver;
         identityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver;
         configurationMutationResolver: ConfigurationMutationResolver;
         configurationQueryResolver: ConfigurationQueryResolver;
+        authPolicyMutationResolver: AuthPolicyMutationResolver;
+        authPolicyQueryResolver: AuthPolicyQueryResolver;
+        customRoleMutationResolver: CustomRoleMutationResolver;
+        customRoleQueryResolver: CustomRoleQueryResolver;
+        authLogQueryResolver: AuthLogQueryResolver;
+        apiKeyQueryResolver: ApiKeyQueryResolver;
         togglePasswordlessMutationResolver: TogglePasswordlessMutationResolver;
     });
     create(): Resolvers & {

package/dist/types/resolvers/ResolverFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResolverFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/ResolverFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,6BAA6B,EAC7B,gCAAgC,EAChC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,EACnC,6BAA6B,EAC7B,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACjH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAA;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAA;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAA;AACtG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAA;AAC7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAA;AAEzG,cAAM,eAAe;IAEnB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE;QAC3B,eAAe,EAAE,eAAe,CAAA;QAChC,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,2BAA2B,EAAE,2BAA2B,CAAA;QACxD,gBAAgB,EAAE,gBAAgB,CAAA;QAClC,yBAAyB,EAAE,yBAAyB,CAAA;QAEpD,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,uBAAuB,EAAE,uBAAuB,CAAA;QAChD,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,8BAA8B,EAAE,8BAA8B,CAAA;QAC9D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,2BAA2B,EAAE,sBAAsB,CAAA;QACnD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,mCAAmC,EAAE,mCAAmC,CAAA;QACxE,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,0BAA0B,EAAE,0BAA0B,CAAA;QAEtD,kCAAkC,EAAE,kCAAkC,CAAA;KACtE;IAGF,MAAM,IAAI,SAAS,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE;CAqG7G;AAED,kBAAU,eAAe,CAAC;IACzB,KAAY,iBAAiB,GAAG;QAC/B,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;KACvB,CAAA;CACD;AAED,OAAO,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"ResolverFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/ResolverFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,qCAAqC,EACrC,mCAAmC,EACnC,6BAA6B,EAC7B,gCAAgC,EAChC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,EACnC,6BAA6B,EAC7B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,4CAA4C,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEhG,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAA;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAA;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAA;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAA;AACzG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAA;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAA;AAChG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,qDAAqD,CAAA;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAA;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAA;AAC5G,OAAO,EAAE,iCAAiC,EAAE,MAAM,wDAAwD,CAAA;AAE1G,cAAM,eAAe;IAEnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE;QAC3B,eAAe,EAAE,eAAe,CAAA;QAChC,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,2BAA2B,EAAE,2BAA2B,CAAA;QACxD,gBAAgB,EAAE,gBAAgB,CAAA;QAClC,yBAAyB,EAAE,yBAAyB,CAAA;QAEpD,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,uBAAuB,EAAE,uBAAuB,CAAA;QAChD,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,8BAA8B,EAAE,8BAA8B,CAAA;QAC9D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,iCAAiC,EAAE,iCAAiC,CAAA;QACpE,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,2BAA2B,EAAE,sBAAsB,CAAA;QACnD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,4CAA4C,EAAE,4CAA4C,CAAA;QAC1F,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,8BAA8B,EAAE,8BAA8B,CAAA;QAC9D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,mCAAmC,EAAE,mCAAmC,CAAA;QACxE,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,wBAAwB,EAAE,wBAAwB,CAAA;QAClD,qCAAqC,EAAE,qCAAqC,CAAA;QAE5E,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,kBAAkB,EAAE,kBAAkB,CAAA;QACtC,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,0BAA0B,EAAE,0BAA0B,CAAA;QAEtD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,uBAAuB,EAAE,uBAAuB,CAAA;QAEhD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,uBAAuB,EAAE,uBAAuB,CAAA;QAEhD,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,kCAAkC,EAAE,kCAAkC,CAAA;KACtE,EACE;IAEJ,MAAM,IAAI,SAAS,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CA+I5G;CACD;AAED,kBAAU,eAAe,CAAC;IACzB,KAAY,iBAAiB,GAAG;QAC/B,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;KACvB,CAAA;CACD;AAED,OAAO,EAAE,eAAe,EAAE,CAAA"}

package/dist/types/resolvers/TenantResolverContext.d.ts

@@ -1,14 +1,22 @@
-import { DatabaseContext, Identity, PermissionContext } from '../model';
+import { DatabaseContext, Identity, PermissionContext } from '../model/index.js';
 import { Logger } from '@contember/logger';
-import { AuthLogService } from '../model/service/AuthLogService';
+import { AuthLogService } from '../model/service/AuthLogService.js';
+export interface TenantResolverHttpInfo {
+    readonly ip: string;
+    readonly userAgent?: string;
+    /** A03: country from the trusted reverse-proxy geo header, when present + trusted. */
+    readonly geoCountry?: string;
+}
 export interface TenantResolverContext {
     readonly apiKeyId: string;
+    readonly trustForwardedInfo: boolean;
     readonly permissionContext: PermissionContext;
     readonly identity: Identity;
     readonly isAllowed: PermissionContext['isAllowed'];
     readonly requireAccess: PermissionContext['requireAccess'];
     readonly db: DatabaseContext;
     readonly logger: Logger;
-    readonly logAuthAction: (entry: AuthLogService.LogArgs) => Promise<void>;
+    readonly logAuthAction: (entry: AuthLogService.LogArgs, db?: DatabaseContext) => Promise<void>;
+    readonly httpInfo: TenantResolverHttpInfo;
 }
 //# sourceMappingURL=TenantResolverContext.d.ts.map

package/dist/types/resolvers/TenantResolverContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantResolverContext.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAEhE,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAClD,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAC1D,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxE"}
+{"version":3,"file":"TenantResolverContext.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAEnE,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAClD,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAC1D,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9F,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CACzC"}

package/dist/types/resolvers/TenantResolverContextFactory.d.ts

@@ -1,32 +1,41 @@
-import { TenantResolverContext } from './TenantResolverContext';
-import { DatabaseContext, PermissionContext, PermissionContextFactory } from '../model';
+import { TenantResolverContext } from './TenantResolverContext.js';
+import { DatabaseContext, LoginRiskAnalyzer, PermissionContext, PermissionContextFactory } from '../model/index.js';
 import { Logger } from '@contember/logger';
-import { AuthLogService } from '../model/service/AuthLogService';
-export declare const createResolverContext: (permissionContext: PermissionContext, apiKeyId: string) => {
+import { AuthLogService } from '../model/service/AuthLogService.js';
+export declare const createResolverContext: (permissionContext: PermissionContext, apiKeyId: string, trustForwardedInfo?: boolean) => {
     apiKeyId: string;
+    trustForwardedInfo: boolean;
     permissionContext: PermissionContext;
-    identity: import("..").Identity;
+    identity: import("../index.js").Identity;
     isAllowed: <Meta extends {} | undefined>({ scope, action, }: {
-        scope?: import("@contember/authorization").AuthorizationScope<import("..").Identity>;
+        scope?: import("@contember/authorization").AuthorizationScope<import("../index.js").Identity>;
         action: import("@contember/authorization").Authorizator.Action<Meta>;
     }) => Promise<boolean>;
     requireAccess: <Meta extends {} | undefined>({ scope, action, message, }: {
-        scope?: import("@contember/authorization").AuthorizationScope<import("..").Identity>;
+        scope?: import("@contember/authorization").AuthorizationScope<import("../index.js").Identity>;
         action: import("@contember/authorization").Authorizator.Action<Meta>;
         message?: string;
     }) => Promise<void>;
+    httpInfo: {
+        ip: string;
+    };
 };
 export declare class TenantResolverContextFactory {
     private readonly permissionContextFactory;
     private readonly authLogService;
-    constructor(permissionContextFactory: PermissionContextFactory, authLogService: AuthLogService);
+    private readonly loginRiskAnalyzer;
+    constructor(permissionContextFactory: PermissionContextFactory, authLogService: AuthLogService, loginRiskAnalyzer: LoginRiskAnalyzer);
     create(authContext: {
         apiKeyId: string;
         identityId: string;
         roles: string[];
+        trustForwardedInfo?: boolean;
     }, httpInfo: {
         ip: string;
         userAgent?: string;
-    }, db: DatabaseContext, logger: Logger): TenantResolverContext;
+        forwarderIp?: string;
+        forwarderUserAgent?: string;
+        geoCountry?: string;
+    }, db: DatabaseContext, logger: Logger): Promise<TenantResolverContext>;
 }
 //# sourceMappingURL=TenantResolverContextFactory.d.ts.map

package/dist/types/resolvers/TenantResolverContextFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantResolverContextFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContextFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAEhE,eAAO,MAAM,qBAAqB,GAAI,mBAAmB,iBAAiB,EAAE,UAAU,MAAM;;;;;aAkBhF,CAAC;;;;aAaR,CAAJ;;eAGE,CAAF;;CA1BA,CAAA;AAED,qBAAa,4BAA4B;IAEvC,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,wBAAwB,EAAE,wBAAwB,EAClD,cAAc,EAAE,cAAc;IAGzC,MAAM,CACZ,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EACtE,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACZ,qBAAqB;CAkBxB"}
+{"version":3,"file":"TenantResolverContextFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContextFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AACnH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAEnE,eAAO,MAAM,qBAAqB,sBAAuB,iBAAiB,YAAY,MAAM;;;;;;;;;;;;;;;QAQ9E,EAAE;;CAEf,CAAA;AAED,qBAAa,4BAA4B;IAEvC,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAHnC,YACkB,wBAAwB,EAAE,wBAAwB,EAClD,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB,EAClD;IAES,MAAM,CAClB,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,EACpG,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EACpH,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CA6BhC;CACD"}

package/dist/types/resolvers/errorUtils.d.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '../model/utils/Response';
+import { ResponseError } from '../model/utils/Response.js';
 type Error<T> = {
     code: T;
     developerMessage: string;

package/dist/types/resolvers/errorUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errorUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/errorUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,IAAI;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;CAAE,CAAA;AAEnG,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,SAAS,EAAE,GAAG,SAAS,EACtF,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,GACnC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AACzB,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;AAiBhH,eAAO,MAAM,6BAA6B,GAAI,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,MAAM,KAAG,aAAa,CAAC,CAAC,CACb,CAAA"}
+{"version":3,"file":"errorUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/errorUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,IAAI;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;CAAE,CAAA;AAEnG,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,SAAS,EAAE,GAAG,SAAS,EACtF,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,GACnC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AACzB,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;AAiBhH,eAAO,MAAM,6BAA6B,GAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAAQ,CAAC,eAAe,MAAM,KAAG,aAAa,CAAC,CAAC,CACb,CAAA"}

package/dist/types/resolvers/index.d.ts

@@ -1,7 +1,7 @@
-export * from './mutation';
-export * from './query';
-export * from './types';
-export * from './TenantResolverContext';
-export * from './ResolverFactory';
-export * from './TenantResolverContextFactory';
+export * from './mutation/index.js';
+export * from './query/index.js';
+export * from './types/index.js';
+export * from './TenantResolverContext.js';
+export * from './ResolverFactory.js';
+export * from './TenantResolverContextFactory.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/resolvers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,SAAS,CAAA;AACvB,cAAc,SAAS,CAAA;AACvB,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,gCAAgC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,mCAAmC,CAAA"}

package/dist/types/resolvers/membershipUtils.d.ts

@@ -1,5 +1,5 @@
-import { MembershipValidationError } from '../model/service/MembershipValidator';
-import { MembershipValidationError as MembershipValidationErrorSchema } from '../schema';
+import { MembershipValidationError } from '../model/service/MembershipValidator.js';
+import { MembershipValidationError as MembershipValidationErrorSchema } from '../schema/index.js';
 export type MembershipErrorCode = 'INVALID_MEMBERSHIP' | 'ROLE_NOT_FOUND' | 'VARIABLE_EMPTY' | 'VARIABLE_NOT_FOUND';
 export interface MembershipErrorVariable {
     code: MembershipErrorCode;

package/dist/types/resolvers/membershipUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAiC,MAAM,sCAAsC,CAAA;AAC/G,OAAO,EAAE,yBAAyB,IAAI,+BAA+B,EAAiC,MAAM,WAAW,CAAA;AAEvH,MAAM,MAAM,mBAAmB,GAC5B,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,mBAAmB,CAAA;IACzB,oBAAoB,CAAC,EAAE,+BAA+B,EAAE,CAAA;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,qCAAqC,GACjD,QAAQ,yBAAyB,EAAE,KACjC,uBAAuB,EAyEzB,CAAA"}
+{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAiC,MAAM,yCAAyC,CAAA;AAClH,OAAO,EAAE,yBAAyB,IAAI,+BAA+B,EAAiC,MAAM,oBAAoB,CAAA;AAEhI,MAAM,MAAM,mBAAmB,GAC5B,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,mBAAmB,CAAA;IACzB,oBAAoB,CAAC,EAAE,+BAA+B,EAAE,CAAA;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,qCAAqC,WACzC,yBAAyB,EAAE,KACjC,uBAAuB,EAyEzB,CAAA"}

package/dist/types/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.d.ts

@@ -1,13 +1,13 @@
-import { CreateApiKeyResponse, MutationCreateApiKeyArgs, MutationCreateGlobalApiKeyArgs, MutationResolvers } from '../../../schema';
+import { CreateApiKeyResponse, MutationCreateApiKeyArgs, MutationCreateGlobalApiKeyArgs, MutationResolvers } from '../../../schema/index.js';
 import { GraphQLResolveInfo } from 'graphql';
-import { TenantResolverContext } from '../../TenantResolverContext';
-import { ApiKeyManager, MembershipValidator, ProjectManager } from '../../../model';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
+import { ApiKeyManager, MembershipValidator, ProjectManager } from '../../../model/index.js';
 export declare class CreateApiKeyMutationResolver implements MutationResolvers {
     private readonly apiKeyManager;
     private readonly projectManager;
     private readonly membershipValidator;
     constructor(apiKeyManager: ApiKeyManager, projectManager: ProjectManager, membershipValidator: MembershipValidator);
-    createApiKey(parent: any, { projectSlug, memberships, description, tokenHash }: MutationCreateApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
-    createGlobalApiKey(parent: any, { roles, description, tokenHash }: MutationCreateGlobalApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
+    createApiKey(parent: any, { projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
+    createGlobalApiKey(parent: any, { roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
 }
 //# sourceMappingURL=CreateApiKeyMutationResolver.d.ts.map

package/dist/types/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,iBAAiB,EACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,aAAa,EAAe,mBAAmB,EAAqB,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKnH,qBAAa,4BAA6B,YAAW,iBAAiB;IAEpE,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAFnB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,mBAAmB,EAAE,mBAAmB;IAGpD,YAAY,CACjB,MAAM,EAAE,GAAG,EACX,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,wBAAwB,EAC9E,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAkC1B,kBAAkB,CACvB,MAAM,EAAE,GAAG,EACX,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,8BAA8B,EACjE,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC;CAkBhC"}
+{"version":3,"file":"CreateApiKeyMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,iBAAiB,EACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,aAAa,EAAe,mBAAmB,EAAqB,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAO5H,qBAAa,4BAA6B,YAAW,iBAAiB;IAEpE,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAHrC,YACkB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,mBAAmB,EAAE,mBAAmB,EACtD;IAEE,YAAY,CACjB,MAAM,EAAE,GAAG,EACX,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,wBAAwB,EACvF,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAwD/B;IAEK,kBAAkB,CACvB,MAAM,EAAE,GAAG,EACX,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,8BAA8B,EAC1E,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAwC/B;CACD"}

package/dist/types/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.d.ts

@@ -1,7 +1,7 @@
-import { DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema';
+import { DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js';
 import { GraphQLResolveInfo } from 'graphql';
-import { TenantResolverContext } from '../../TenantResolverContext';
-import { ApiKeyManager } from '../../../model';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
+import { ApiKeyManager } from '../../../model/index.js';
 export declare class DisableApiKeyMutationResolver implements MutationResolvers {
     private readonly apiKeyManager;
     constructor(apiKeyManager: ApiKeyManager);

package/dist/types/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,qBAAqB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC7H,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,aAAa,EAAqB,MAAM,gBAAgB,CAAA;AAGjE,qBAAa,6BAA8B,YAAW,iBAAiB;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEnD,aAAa,CAClB,MAAM,EAAE,GAAG,EACX,EAAE,EAAE,EAAE,EAAE,yBAAyB,EACjC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,qBAAqB,CAAC;CAiBjC"}
+{"version":3,"file":"DisableApiKeyMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,qBAAqB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACtI,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,aAAa,EAAqB,MAAM,yBAAyB,CAAA;AAI1E,qBAAa,6BAA8B,YAAW,iBAAiB;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA1C,YAA6B,aAAa,EAAE,aAAa,EAAI;IAEvD,aAAa,CAClB,MAAM,EAAE,GAAG,EACX,EAAE,EAAE,EAAE,EAAE,yBAAyB,EACjC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAsBhC;CACD"}

package/dist/types/resolvers/mutation/apiKey/index.d.ts

@@ -1,3 +1,3 @@
-export * from './CreateApiKeyMutationResolver';
-export * from './DisableApiKeyMutationResolver';
+export * from './CreateApiKeyMutationResolver.js';
+export * from './DisableApiKeyMutationResolver.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/resolvers/mutation/apiKey/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAA;AAC9C,cAAc,iCAAiC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAA;AACjD,cAAc,oCAAoC,CAAA"}

package/dist/types/resolvers/mutation/configuration/AuthPolicyMutationResolver.d.ts

@@ -0,0 +1,17 @@
+import { CreateAuthPolicyResponse, DeleteAuthPolicyResponse, MutationCreateAuthPolicyArgs, MutationDeleteAuthPolicyArgs, MutationResolvers, MutationUpdateAuthPolicyArgs, UpdateAuthPolicyResponse } from '../../../schema/index.js';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
+import { AuthPolicyManager } from '../../../model/index.js';
+/**
+ * CRUD over `auth_policy` (per-role MFA / session policy). Gated like
+ * `configure` (a tenant-wide admin action). Every mutation audits
+ * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.
+ */
+export declare class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {
+    private readonly authPolicyManager;
+    constructor(authPolicyManager: AuthPolicyManager);
+    createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse>;
+    updateAuthPolicy(parent: any, { id, policy }: MutationUpdateAuthPolicyArgs, context: TenantResolverContext): Promise<UpdateAuthPolicyResponse>;
+    deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse>;
+    private mapInput;
+}
+//# sourceMappingURL=AuthPolicyMutationResolver.d.ts.map

package/dist/types/resolvers/mutation/configuration/AuthPolicyMutationResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,EAC5B,iBAAiB,EACjB,4BAA4B,EAC5B,wBAAwB,EACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,yBAAyB,CAAA;AAK9E;;;;GAIG;AACH,qBAAa,0BAA2B,YAAW,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;IAEtI,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IADnC,YACkB,iBAAiB,EAAE,iBAAiB,EAClD;IAEE,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsB/I;IAEK,gBAAgB,CACrB,MAAM,EAAE,GAAG,EACX,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,4BAA4B,EAC5C,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,wBAAwB,CAAC,CAsBnC;IAEK,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAqB3I;IAED,OAAO,CAAC,QAAQ;CAYhB"}

package/dist/types/resolvers/mutation/configuration/ConfigurationMutationResolver.d.ts

@@ -1,6 +1,6 @@
-import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema';
-import { ConfigurationManager } from '../../../model/service/ConfigurationManager';
-import { TenantResolverContext } from '../../TenantResolverContext';
+import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js';
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager.js';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
 export declare class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {
     private readonly configurationManager;
     constructor(configurationManager: ConfigurationManager);

package/dist/types/resolvers/mutation/configuration/ConfigurationMutationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAInE,qBAAa,6BAA8B,YAAW,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;IAExF,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAItD,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAgB3H"}
+{"version":3,"file":"ConfigurationMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACnH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAA;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAMtE,qBAAa,6BAA8B,YAAW,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC;IAExF,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IADtC,YACkB,oBAAoB,EAAE,oBAAoB,EAE3D;IAEK,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuB1H;CACD"}

package/dist/types/resolvers/mutation/customRole/CustomRoleMutationResolver.d.ts

@@ -0,0 +1,16 @@
+import { CreateCustomRoleResponse, DeleteCustomRoleResponse, MutationCreateCustomRoleArgs, MutationDeleteCustomRoleArgs, MutationResolvers, MutationUpdateCustomRoleArgs, UpdateCustomRoleResponse } from '../../../schema/index.js';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
+import { CustomRoleManager } from '../../../model/index.js';
+/**
+ * CRUD over `custom_role` (runtime-defined global roles). Gated by `customRole:manage`,
+ * which is deliberately NOT grantable to a custom role — by default only SUPER_ADMIN
+ * (via the wildcard grant) can manage role definitions.
+ */
+export declare class CustomRoleMutationResolver implements Pick<MutationResolvers, 'createCustomRole' | 'updateCustomRole' | 'deleteCustomRole'> {
+    private readonly customRoleManager;
+    constructor(customRoleManager: CustomRoleManager);
+    createCustomRole(parent: any, args: MutationCreateCustomRoleArgs, context: TenantResolverContext): Promise<CreateCustomRoleResponse>;
+    updateCustomRole(parent: any, args: MutationUpdateCustomRoleArgs, context: TenantResolverContext): Promise<UpdateCustomRoleResponse>;
+    deleteCustomRole(parent: any, args: MutationDeleteCustomRoleArgs, context: TenantResolverContext): Promise<DeleteCustomRoleResponse>;
+}
+//# sourceMappingURL=CustomRoleMutationResolver.d.ts.map

package/dist/types/resolvers/mutation/customRole/CustomRoleMutationResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/customRole/CustomRoleMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,EAC5B,iBAAiB,EACjB,4BAA4B,EAC5B,wBAAwB,EACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,yBAAyB,CAAA;AAI9E;;;;GAIG;AACH,qBAAa,0BAA2B,YAAW,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;IAEtI,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IADnC,YACkB,iBAAiB,EAAE,iBAAiB,EAClD;IAEE,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAuCzI;IAEK,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6BzI;IAEK,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA2BzI;CACD"}

package/dist/types/resolvers/mutation/identity/GlobalRolesMutationResolver.d.ts

@@ -1,11 +1,12 @@
-import { AddGlobalIdentityRolesResponse, MutationAddGlobalIdentityRolesArgs, MutationRemoveGlobalIdentityRolesArgs, MutationResolvers, RemoveGlobalIdentityRolesResponse } from '../../../schema';
+import { AddGlobalIdentityRolesResponse, MutationAddGlobalIdentityRolesArgs, MutationRemoveGlobalIdentityRolesArgs, MutationResolvers, RemoveGlobalIdentityRolesResponse } from '../../../schema/index.js';
 import { GraphQLResolveInfo } from 'graphql';
-import { TenantResolverContext } from '../../TenantResolverContext';
-import { RolesManager } from '../../../model';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
+import { RolesManager } from '../../../model/index.js';
 export declare class IdentityGlobalRolesMutationResolver implements MutationResolvers {
     private readonly rolesManager;
     constructor(rolesManager: RolesManager);
     addGlobalIdentityRoles(parent: any, { roles, identityId }: MutationAddGlobalIdentityRolesArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<AddGlobalIdentityRolesResponse>;
     removeGlobalIdentityRoles(parent: any, { roles, identityId }: MutationRemoveGlobalIdentityRolesArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<RemoveGlobalIdentityRolesResponse>;
+    private logRolesChange;
 }
 //# sourceMappingURL=GlobalRolesMutationResolver.d.ts.map

package/dist/types/resolvers/mutation/identity/GlobalRolesMutationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,8BAA8B,EAC9B,kCAAkC,EAClC,qCAAqC,EACrC,iBAAiB,EACjB,iCAAiC,EACjC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,qBAAa,mCAAoC,YAAW,iBAAiB;IAE3E,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,YAAY;IAItC,sBAAsB,CAC3B,MAAM,EAAE,GAAG,EACX,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,kCAAkC,EACzD,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,8BAA8B,CAAC;IAoBpC,yBAAyB,CAC9B,MAAM,EAAE,GAAG,EACX,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,qCAAqC,EAC5D,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,iCAAiC,CAAC;CAmB7C"}
+{"version":3,"file":"GlobalRolesMutationResolver.d.ts","sourceRoot":"","sources":["../../../../../src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,8BAA8B,EAC9B,kCAAkC,EAClC,qCAAqC,EACrC,iBAAiB,EACjB,iCAAiC,EACjC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAA2D,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAM/G,qBAAa,mCAAoC,YAAW,iBAAiB;IAE3E,OAAO,CAAC,QAAQ,CAAC,YAAY;IAD9B,YACkB,YAAY,EAAE,YAAY,EAE3C;IAEK,sBAAsB,CAC3B,MAAM,EAAE,GAAG,EACX,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,kCAAkC,EACzD,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,8BAA8B,CAAC,CAiCzC;IAEK,yBAAyB,CAC9B,MAAM,EAAE,GAAG,EACX,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,qCAAqC,EAC5D,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,iCAAiC,CAAC,CAgC5C;YAEa,cAAc;CAkB5B"}

package/dist/types/resolvers/mutation/identity/index.d.ts

@@ -1,2 +1,2 @@
-export * from './GlobalRolesMutationResolver';
+export * from './GlobalRolesMutationResolver.js';
 //# sourceMappingURL=index.d.ts.map